{"count":20,"data":[{"name":"analytics-header-filter","version":"1.0","displayName":"Analytics Header Filter","description":"The Analytics Header Filter policy allows you to control which request and response headers \nare included in analytics data using allow or deny modes. This policy is intended to prevent sensitive, \nnoisy, or irrelevant headers from being sent to analytics backends while preserving the rest of the request \nand response context.\n\nThe policy only affects analytics data collection. It does not remove or modify headers sent to upstream \nservices or returned to clients.","provider":"WSO2","categories":["Logging","Analytics \u0026 Monitoring"],"isLatest":true},{"name":"api-key-auth","version":"1.2","displayName":"API Key Auth","description":"Implements API Key Authentication to protect APIs with pre-shared API keys.\nValidates API keys from request headers against a configured\nlist of valid keys and sets authentication metadata in the request context.","provider":"WSO2","categories":["Security","AI","WebSub"],"isLatest":true},{"name":"aws-authentication","version":"0.10","displayName":"AWS Authentication","description":"Signs outbound requests to AWS-hosted backends using AWS Signature Version 4 (SigV4).\nSupports four credential-acquisition modes: AWS STS AssumeRole for temporary credentials,\na static IAM user access key/secret pair, IAM Roles for Service Accounts (IRSA) on\nKubernetes clusters federated with AWS IAM via OIDC (e.g. EKS), or the AWS SDK's default\ncredential provider chain for compute already running under the target IAM role. Intended\nfor backends such as API Gateway with IAM auth, Lambda Function URLs, OpenSearch, and S3\nthat require SigV4-signed requests.","provider":"WSO2","categories":["Security","AI"],"isLatest":true},{"name":"aws-bedrock-guardrail","version":"1.0","displayName":"AWS Bedrock Guardrail","description":"Validates request or response body content against AWS Bedrock Guardrails.\nSupports content filtering, topic detection, word filtering, and PII detection/masking.\nSupports three authentication modes: role-based (AssumeRole), static credentials, or default credential chain.\nSupports JSONPath extraction to validate specific fields within JSON payloads.\nSupports separate configuration for request and response phases.","provider":"WSO2","categories":["Guardrails","AI"],"isLatest":true},{"name":"azure-content-safety-content-moderation","version":"1.0","displayName":"Azure Content Safety Content Moderation","description":"Validates request or response body content against Azure Content Safety API for content moderation.\nSupports detection of hate speech, sexual content, self-harm, and violence with configurable severity thresholds.\nSupports JSONPath extraction to validate specific fields within JSON payloads.\nSupports separate configuration for request and response phases.","provider":"WSO2","categories":["Guardrails","AI"],"isLatest":true},{"name":"backend-jwt","version":"1.0","displayName":"Backend JWT","description":"Generates a signed JWT containing authenticated user information and injects it into the upstream request header. Designed to run after an authentication policy so that backend services can verify caller identity without access to the original client credential.","provider":"WSO2","categories":["Security"],"isLatest":true},{"name":"basic-auth","version":"1.0","displayName":"Basic Auth","description":"Implements HTTP Basic Authentication to protect APIs with username and password credentials.\nValidates the Authorization header against configured credentials and sets authentication\nmetadata in the request context for downstream policies to use.","provider":"WSO2","categories":["Security","AI","WebSub"],"isLatest":true},{"name":"content-length-guardrail","version":"1.0","displayName":"Content Length Guardrail","description":"Validates the byte length of request or response body content.\nSupports JSONPath extraction to validate specific fields within JSON payloads.\nCan be configured with min/max byte length constraints and inverted logic.\nSupports separate configuration for request and response phases.","provider":"WSO2","categories":["Guardrails","AI"],"isLatest":true},{"name":"cors","version":"1.0","displayName":"CORS","description":"Cross-Origin Resource Sharing (CORS) policy that handles preflight requests and adds\nappropriate CORS headers to responses. Enables controlled access to resources from different\norigins by configuring allowed origins, methods, headers, and credentials.","provider":"WSO2","categories":["Security","AI","MCP"],"isLatest":true},{"name":"dynamic-endpoint","version":"1.0","displayName":"Dynamic Endpoint","description":"Routes requests to a named upstream definition at request time.\nUses a single required targetUpstream parameter to select the upstream definition.\nUseful for directing specific API routes or operations to alternate backends.","provider":"WSO2","categories":["Transformation"],"isLatest":true},{"name":"granite-guardian-prompt-injection","version":"0.9","displayName":"Granite Guardian Prompt Injection","description":"Detects prompt injection and jailbreak attempts in LLM API requests using IBM Granite Guardian 3.3 8B.\nBuffers the request body, extracts the user message via a configurable JSONPath expression, and forwards\nit to a Granite Guardian inference endpoint. Requests flagged above the configured confidence threshold\nare rejected before reaching the upstream LLM. Supports multiple risk categories, configurable blocking\nstatus codes, and fail-open or fail-closed error handling.","provider":"WSO2","categories":["Guardrails","AI"],"isLatest":true},{"name":"host-rewrite","version":"1.0","displayName":"Host Rewrite","description":"Sets the Host/:authority header sent to the upstream. Useful when the upstream requires a specific Host value different from the incoming request. Requires upstream.hostRewrite set to 'manual'.","provider":"WSO2","categories":["Transformation"],"isLatest":true},{"name":"interceptor-service","version":"1.0","displayName":"Interceptor Service","description":"Invokes a user-defined HTTP interceptor service in the request and/or response phase. The interceptor can mutate headers, body, path, route to a dynamic endpoint, or short-circuit the chain with a direct response.","provider":"WSO2","categories":["Transformation"],"isLatest":true},{"name":"json-schema-guardrail","version":"1.0","displayName":"JSON Schema Guardrail","description":"Validates request or response body content against a JSON Schema.\nSupports JSONPath extraction to validate specific fields within JSON payloads.\nCan be configured with inverted logic to pass when schema validation fails.\nSupports separate configuration for request and response phases.","provider":"WSO2","categories":["Guardrails","AI"],"isLatest":true},{"name":"json-xml-mediator","version":"1.0","displayName":"JSON/XML Mediator","description":"Mediates request and response payloads between downstream and upstream JSON/XML formats.\nAutomatically converts requests from the downstream format to the upstream format, and responses\nfrom the upstream format back to the downstream format.","provider":"WSO2","categories":["Transformation"],"isLatest":true},{"name":"jwt-auth","version":"1.0","displayName":"JWT Auth","description":"Validates JWT access tokens using one or more JWKS providers (key managers).\nSystem-level configuration holds key manager endpoints and fetch behavior.\nUser-level configuration holds per-route assertions (selected issuers, audiences, scopes, claims and mappings).","provider":"WSO2","categories":["Security","AI","WebSub"],"isLatest":true},{"name":"llm-cost","version":"1.0","displayName":"LLM Cost","description":"Calculates the monetary cost of LLM API calls at response time and stores the result in SharedContext for use by downstream policies. Supports OpenAI, Anthropic, Gemini, and Mistral providers with automatic model pricing lookup.","provider":"WSO2","categories":["AI"],"isLatest":true},{"name":"llm-cost-based-ratelimit","version":"1.0","displayName":"LLM Cost Based Ratelimit","description":"A specialized rate limiting policy that enforces monetary budget limits on LLM API usage. Reads pre-calculated costs from the llm-cost policy and blocks requests when configured spending budgets are exceeded within the defined time windows.","provider":"WSO2","categories":["AI"],"isLatest":true},{"name":"log-message","version":"1.0","displayName":"Log Message","description":"This policy provides the capability to log the payload and headers of a request/response.\nIt supports separate configuration for request and response flows.\nSupports streaming (SSE) payloads by logging each chunk independently as it arrives.","provider":"WSO2","categories":["Logging","Analytics \u0026 Monitoring","MCP","WebSub"],"isLatest":true},{"name":"mcp-acl-list","version":"1.0","displayName":"MCP Access Control","description":"MCP ACL List policy controls access to tools, resources, and prompts using\nmode and exceptions. It filters list responses based on the configured mode\nand enforces the same allow/deny rules on request paths. This policy does not\nrewrite capability fields (tools, resources, or prompts) or modify list entry contents.\n\n- Missing capability config: Allow all capabilities of that type\n- mode: allow, exceptions: [..] =\u003e allow all except listed exceptions\n- mode: deny, exceptions: [..] =\u003e deny all except listed exceptions","provider":"WSO2","categories":["MCP","AI"],"isLatest":true}],"pagination":{"offset":0,"limit":20,"total":48},"meta":{"trace_id":"c2750192-a662-41e4-9e8b-a7b229d7948c","timestamp":"2026-07-23T04:14:52.103096717Z","request_id":"2f358a06-0eb1-4b5d-8b4a-62e95000cfbc"}}