Docs

Policy Library

Zuplo policies define gateway behavior. Each is a named JSON object in your routes.json, placed in an ordered inbound or outbound chain.

Inbound policies

Inbound policies run before forwarding to the upstream. Use them for authentication, rate limiting, request transforms, and routing.

Authentication

api-key-inbound inbound

Checks Zuplo-managed API keys in the Authorization: Bearer header and sets consumer identity in request context for downstream policies.

{ "policyType": "api-key-inbound", "options": { "allowAnonymous": false } }

jwt-inbound inbound

Validates JWTs, fetches the JWKS endpoint automatically, and uses a configurable claim for consumer identity.

{ "policyType": "jwt-inbound", "options": { "jwksUrl": "$env(JWKS_URL)", "consumerIdentityClaim": "sub" } }

Rate Limiting

rate-limit-inbound inbound

Limits requests with fixed or sliding windows, keyed by consumer identity, IP, or a custom selector expression.

token-bucket-inbound inbound

Uses a token bucket. Set bucketCapacity and refillRate for short bursts with a sustained throughput limit.

token-budget-inbound inbound

Tracks each consumer's LLM token use over a rolling window. Returns 429 when exhausted; reset options are hourly, daily, or monthly.

Routing

llm-routing-inbound inbound

Sends requests across prioritized LLM providers with failover, weighted balancing, latency-aware selection, and normalization between OpenAI and Anthropic formats.

mcp-session-guard-inbound inbound

Manages the MCP lifecycle: session initialization, authentication, per-session tool call limits, and expiry, over SSE or WebSocket transports.

Request transformation

set-headers-inbound inbound

Adds or replaces request headers before forwarding. Inject upstream auth headers without exposing them to the caller.

request-body-transform-inbound inbound

Transforms request JSON with a JMESPath or JSONata expression to reshape payloads between your API contract and upstream.

Outbound policies

Outbound policies run after the upstream response arrives and before it reaches the caller. Use them for response transforms, logging, and headers.

set-headers-outbound outbound

Adds or replaces response headers for CORS, caching directives, or security.

response-body-transform-outbound outbound

Transforms response JSON with a JMESPath or JSONata expression to normalize upstream shapes before returning them to the caller.

audit-log-outbound outbound

Emits a structured audit event for each request-response pair with consumer identity, upstream, latency, status, and available token counts. Sends it to the configured log destination.

Policy execution order

Policies in the inbound array run first to last. Policies in the outbound array run in reverse, with the last list item first on the response. This follows the standard middleware onion model.

{
  "policies": {
    "inbound": [
      { "name": "auth", "policyType": "api-key-inbound" },    // runs first
      { "name": "rate-limit", "policyType": "rate-limit-inbound" }  // runs second
    ],
    "outbound": [
      { "name": "log", "policyType": "audit-log-outbound" },    // executes second on response
      { "name": "headers", "policyType": "set-headers-outbound" } // executes first on response
    ]
  }
}