Payload schema
rulesobject[]
The complete ordered rule list now in force.
ruleKeystring
Caller-provided identifier; the requested event names the rule that caught it.
descriptionstringoptional
Human-readable "why was this caught" line, shown on the approval prompt.
matchobjectoptional
Matchers of one egress rule. Absent fields match everything.
hostsstring[]optional
Hostnames, with `*.` wildcard support: "api.stripe.com", "*.stripe.com".
methodsstring[]optional
HTTP methods (case-insensitive): ["POST", "DELETE"].
pathPrefixstringoptional
URL path prefix: "/v1/transfers".
secretPathsstring[]optional
Secret paths the request references (getSecret placeholders). The secret-aware trigger: "any request spending /secrets/stripe/prod needs a human", regardless of destination.
verdict"hold" | "deny"
hold parks the request for a human; deny refuses it outright.
approvalTimeoutMsintegeroptional
How long a held request waits for a human before auto-rejecting.
Raw JSON schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"properties": {
"rules": {
"type": "array",
"items": {
"type": "object",
"properties": {
"ruleKey": {
"type": "string",
"minLength": 1,
"description": "Caller-provided identifier; the requested event names the rule that caught it."
},
"description": {
"default": "",
"description": "Human-readable \"why was this caught\" line, shown on the approval prompt.",
"type": "string"
},
"match": {
"default": {},
"description": "Matchers of one egress rule. Absent fields match everything.",
"type": "object",
"properties": {
"hosts": {
"description": "Hostnames, with `*.` wildcard support: \"api.stripe.com\", \"*.stripe.com\".",
"type": "array",
"items": {
"type": "string"
}
},
"methods": {
"description": "HTTP methods (case-insensitive): [\"POST\", \"DELETE\"].",
"type": "array",
"items": {
"type": "string"
}
},
"pathPrefix": {
"description": "URL path prefix: \"/v1/transfers\".",
"type": "string"
},
"secretPaths": {
"description": "Secret paths the request references (getSecret placeholders). The secret-aware trigger: \"any request spending /secrets/stripe/prod needs a human\", regardless of destination.",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"verdict": {
"type": "string",
"enum": [
"hold",
"deny"
],
"description": "hold parks the request for a human; deny refuses it outright."
},
"approvalTimeoutMs": {
"default": 600000,
"description": "How long a held request waits for a human before auto-rejecting.",
"type": "integer",
"exclusiveMinimum": 0,
"maximum": 3600000
}
},
"required": [
"ruleKey",
"verdict"
]
},
"description": "The complete ordered rule list now in force."
}
},
"required": [
"rules"
]
}