HTTP plugins

Every http plugin the console offers, by category.

Authentication19

• authz-casbinAuthorizes requests with a Casbin model and policy.
• authz-casdoorAuthenticates users against a Casdoor instance.
• authz-keycloakAuthorizes requests with Keycloak's authorization services.
• basic-authAuthenticates consumers with HTTP Basic credentials.
• cas-authAuthenticates users against a CAS server.
• dingtalk-authAuthenticates users with a DingTalk account through OAuth.
• feishu-authAuthenticates users with a Feishu (Lark) account through OAuth.
• forward-authDelegates authentication to an external service.
• hmac-authAuthenticates requests signed with an HMAC key pair.
• jwe-decryptDecrypts a JWE token from the request and forwards its payload.
• jwt-authAuthenticates consumers with a JSON Web Token they present.
• key-authAuthenticates consumers with an API key sent in a header or query parameter.
• ldap-authAuthenticates consumers against an LDAP directory.
• ldap-auth-advancedAuthenticates consumers against LDAP with a service-account bind and a user search.
• multi-authAccepts any one of several authentication plugins.
• opaAuthorizes requests with Open Policy Agent.
• openid-connectAuthenticates users against an OpenID Connect provider.
• saml-authAuthenticates users with a SAML identity provider.
• wolf-rbacAuthorizes requests with wolf role-based access control.

Security10

• aclAllows or denies consumers by the labels they carry.
• chaitin-wafSends requests to a Chaitin WAF for inspection.
• consumer-restrictionAllows or denies requests by consumer, group, route or service.
• corsAdds CORS headers so browsers can call the API from other origins.
• csrfProtects state-changing requests against cross-site request forgery.
• ip-restrictionAllows or denies clients by IP address or CIDR range.
• public-apiExposes an internal API of the engine on a route.
• referer-restrictionAllows or denies requests by their Referer header.
• ua-restrictionAllows or denies clients by their User-Agent.
• uri-blockerBlocks requests whose URI matches a rule.

Traffic17

• api-breakerBreaks the circuit to an unhealthy upstream and returns a fixed response.
• client-controlControls the client request body size.
• graphql-limit-countLimits GraphQL requests by their query cost.
• graphql-proxy-cacheCaches GraphQL responses.
• limit-connLimits concurrent connections per key.
• limit-countLimits the number of requests in a time window, per key.
• limit-reqLimits the request rate with a leaky bucket.
• oas-validatorValidates requests against an OpenAPI document; responses are not checked.
• proxy-bufferingControls response buffering from the upstream.
• proxy-cacheCaches upstream responses on disk or in memory.
• proxy-controlControls request buffering for the upstream.
• proxy-mirrorMirrors requests to another upstream.
• request-idAdds a unique request ID header to requests and responses.
• request-validationValidates request headers and body against a JSON Schema.
• traffic-labelLabels requests for later plugins by match rules.
• traffic-splitSplits traffic between upstreams by weight and match rules.
• workflowRuns different plugins for different matched requests.

Transformation10

• attach-consumer-labelAdds the consumer's labels to request headers for the upstream.
• body-transformerRewrites request and response bodies with templates.
• data-maskMasks or removes sensitive request data in the log lines, after the upstream has seen it.
• degraphqlMaps REST endpoints onto a GraphQL upstream.
• fault-injectionInjects delays or fixed responses for testing.
• grpc-transcodeTranslates HTTP and JSON requests into gRPC calls and back.
• grpc-webLets gRPC-Web browser clients reach a gRPC upstream.
• mockingAnswers requests with a mocked response instead of an upstream.
• proxy-rewriteRewrites the request URI, method, host and headers before proxying.
• response-rewriteRewrites the response status, headers and body.

Observability20

• clickhouse-loggerSends request logs to a ClickHouse table.
• datadogSends request metrics to a Datadog agent.
• elasticsearch-loggerSends request logs to an Elasticsearch index.
• file-loggerWrites request logs to a file on the engine's node.
• google-cloud-loggingSends request logs to Google Cloud Logging.
• http-loggerSends request logs to an HTTP endpoint in batches.
• kafka-loggerSends request logs to a Kafka topic.
• lagoSends usage events to Lago for metering and billing.
• logglySends request logs to Loggly.
• loki-loggerSends request logs to Grafana Loki.
• prometheusExposes request metrics for Prometheus.
• rocketmq-loggerSends request logs to a RocketMQ topic.
• skywalking-loggerSends request logs to Apache SkyWalking.
• sls-loggerSends request logs to Alibaba Cloud Log Service.
• splunk-hec-loggingSends request logs to a Splunk HTTP Event Collector.
• syslogSends request logs to a syslog server.
• tcp-loggerSends request logs to a TCP server.
• tencent-cloud-clsSends request logs to Tencent Cloud Log Service.
• udp-loggerSends request logs to a UDP server.
• zipkinSends traces to a Zipkin collector.

AI15

• aiAn internal routing speed-up with no settings; added here it does nothing to requests.
• ai-aliyun-content-moderationModerates request content with Alibaba Cloud before the LLM.
• ai-aws-content-moderationModerates request content with AWS Comprehend before the LLM.
• ai-cacheCaches LLM responses by exact or semantic match.
• ai-lakera-guardChecks prompts with Lakera Guard before the LLM.
• ai-prompt-decoratorPrepends or appends messages to the prompt sent to the LLM.
• ai-prompt-guardAllows or denies prompts that match configured patterns.
• ai-prompt-templateBuilds the prompt from a template and the request's variables.
• ai-proxyProxies requests to an LLM provider with a unified API.
• ai-proxy-multiProxies requests to several LLM providers with balancing and fallback.
• ai-ragAdds retrieved documents to the prompt from a vector search.
• ai-rate-limitingLimits requests to an LLM provider by tokens or count.
• ai-request-rewriteRewrites the request body with an LLM before proxying.
• mcp-bridgeBridges an MCP server's stdio transport over HTTP.
• openapi-to-mcpServes an HTTP API to MCP clients from its OpenAPI document.

Serverless6

• aws-lambdaInvokes an AWS Lambda function as the upstream.
• azure-functionsInvokes an Azure Function as the upstream.
• openfunctionInvokes an OpenFunction function as the upstream.
• openwhiskInvokes an Apache OpenWhisk action as the upstream.
• serverless-post-functionRuns Lua functions after the other plugins of a phase.
• serverless-pre-functionRuns Lua functions before the other plugins of a phase.

General9

• echoReplaces or wraps the upstream response body and adds response headers, for testing.
• example-pluginExample plugin of the engine's source tree.
• ext-plugin-post-reqRuns external plugins in the access phase, after the built-in ones.
• ext-plugin-post-respRuns external plugins on the response before it returns.
• ext-plugin-pre-reqRuns external plugins before the request reaches the upstream.
• gzipCompresses responses with gzip.
• inspectEnables dynamic Lua inspection on the engine, for debugging.
• real-ipTakes the client address from a header or variable behind a proxy.
• redirectRedirects requests to another URI or to HTTPS.

Other protocols3

• http-dubboTranslates HTTP requests into Dubbo calls.
• kafka-proxyCarries the SASL credentials a Kafka upstream is dialled with.
• websocket-proxySets the largest WebSocket message, per direction, a ws or wss upstream may exchange.