Gateway auth policy

Package: agentrouter.admin.v1 Service: GatewayAuthPolicyService

Endpoints

Create gateway auth policy

Changed in v0.11.0 (security updates): A jwt gateway auth policy must now name at least one audience, and a jit identity mapping rule must set claim_value_template or set match_every_claim_value to true. A policy stored with no audience can still be updated without one. A jit rule without jit_principal_cap now creates no principal once its project holds 100 external principals.

Changed in v0.10.0 (behaviour changes): Creating a GatewayAuthPolicy, or changing its extraction_header, is now refused when the header is x-tars-project or x-tars-project-id, because the data plane reads either one as the request's project. A policy already stored with one of them keeps it, and a data plane on 0.10.0 refuses the token calls it verifies with extraction_header_conflict, including calls that send the token in Authorization.

Changed in v0.7.0 (behaviour changes): Creating a gateway auth policy, or changing its jwks_uri, is now refused when the jwks_uri carries a user name or password, writes an IPv4 address as anything other than a dotted quad, or names or resolves to a carrier-grade NAT, multicast, reserved or other internal address. Existing policies keep working, and an update that leaves jwks_uri as it is still succeeds.

Changed in v0.7.0 (behaviour changes): Creating a gateway auth policy, or changing its jwks_inline key set, is now refused when the key set holds more than 32 keys or more than 16 KiB. Existing policies keep their key sets, and an update that leaves jwks_inline as it is still succeeds.

Changed in v0.7.0 (behaviour changes): Creating a gateway auth policy, or changing its extraction_header, is now refused unless the gateway can remove that header after verifying the token, which rules out the identity headers the gateway sets and credential headers such as x-api-key, cookie and proxy-authorization. Existing policies keep their header, and the data plane and management plane log a warning for each enabled policy that reads such a header.

Changed in v0.7.0 (new features): A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: Create a gateway auth policy (one authentication mechanism on a gateway).

Request fields:

Field	Required	Description
`customer_id`	no	undocumented
`project_id`	no	undocumented
`project_gateway_id`	no	undocumented
`name`	no	undocumented
`mechanism`	no	Mechanism; validated against the supported set in valet ("jwt").
`issuer`	no	undocumented
`jwks_uri`	no	undocumented
`jwks_inline`	no	undocumented
`audiences`	no	Audiences a token's aud claim must hold one of. A jwt policy must name at least one and at most 8. With none, the gateway would accept every token its issuer signs whatever its aud claim, and on a multi-tenant issuer such as GitHub Actions every caller chooses its own aud.
`extraction_header`	no	undocumented
`enabled`	no	Omitted means enabled, matching the column default. A plain bool would read as false when absent and silently create a disabled policy.
`required_scopes`	no	Scopes a token from this issuer must carry, every one of them. jwt only, at most 16, each an RFC 6749 scope-token (printable ASCII with no space, quote or backslash) of at most 253 characters, and case-sensitive.
`environment_claim`	no	Name of the token claim carrying the environment the token was issued for (fraser#9288), which the data plane compares against the environment of the project gateway serving the request. The data plane refuses a token that lacks the claim, a token whose claim is not a string or an array holding the gateway's environment, and every token while the gateway declares no environment. Unset or empty means the policy names no environment claim. At most 255 characters, and the registered claims iss, sub, aud, exp, nbf, iat and jti are refused. An enabled policy setting it is refused with FAILED_PRECONDITION while a live project gateway carrying project_gateway_id declares no environment. Set the gateway's environment with UpdateProjectGateway first.

Response fields:

Field	Required	Description
`policy`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) CreateGatewayAuthPolicy(ctx context.Context, req *adminv1.CreateGatewayAuthPolicyRequest) (*adminv1.CreateGatewayAuthPolicyResponse, error)","python":"create_gateway_auth_policy(req: gateway_auth_policy_pb2.CreateGatewayAuthPolicyRequest) -\u003e CreateGatewayAuthPolicyResponse","typescript":"createGatewayAuthPolicy(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.CreateGatewayAuthPolicyRequestSchema\u003e): Promise\u003cCreateGatewayAuthPolicyResponse\u003e","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"customer_id\": \"...\",\n    \"project_id\": \"...\",\n    \"project_gateway_id\": \"...\",\n    \"name\": \"...\",\n    \"mechanism\": \"...\",\n    \"issuer\": \"...\",\n    \"jwks_uri\": \"...\",\n    \"jwks_inline\": {},\n    \"audiences\": [],\n    \"extraction_header\": \"...\",\n    \"enabled\": false,\n    \"required_scopes\": [],\n    \"environment_claim\": \"...\"\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.CreateGatewayAuthPolicyRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().CreateGatewayAuthPolicy(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/creategatewayauthpolicy\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.CreateGatewayAuthPolicyRequest()\ntry:\n    result = client.gateway_auth_policy.create_gateway_auth_policy(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.createGatewayAuthPolicy(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"customer_id\": \"...\",\n    \"project_id\": \"...\",\n    \"project_gateway_id\": \"...\",\n    \"name\": \"...\",\n    \"mechanism\": \"...\",\n    \"issuer\": \"...\",\n    \"jwks_uri\": \"...\",\n    \"jwks_inline\": {},\n    \"audiences\": [],\n    \"extraction_header\": \"...\",\n    \"enabled\": false,\n    \"required_scopes\": [],\n    \"environment_claim\": \"...\"\n  }'"},"persona":"Admin","httpVerb":"POST","httpPath":"/admin/v1/gateway-auth-policies","slug":"create-gateway-auth-policy"}

Get gateway auth policy

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: Get a gateway auth policy by id.

Request fields:

Field	Required	Description
`id`	no	undocumented

Response fields:

Field	Required	Description
`policy`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) GetGatewayAuthPolicy(ctx context.Context, req *adminv1.GetGatewayAuthPolicyRequest) (*adminv1.GetGatewayAuthPolicyResponse, error)","python":"get_gateway_auth_policy(req: gateway_auth_policy_pb2.GetGatewayAuthPolicyRequest) -\u003e GetGatewayAuthPolicyResponse","typescript":"getGatewayAuthPolicy(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.GetGatewayAuthPolicyRequestSchema\u003e): Promise\u003cGetGatewayAuthPolicyResponse\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.GetGatewayAuthPolicyRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().GetGatewayAuthPolicy(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/getgatewayauthpolicy\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.GetGatewayAuthPolicyRequest()\ntry:\n    result = client.gateway_auth_policy.get_gateway_auth_policy(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.getGatewayAuthPolicy(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"GET","httpPath":"/admin/v1/gateway-auth-policies/{id}","slug":"get-gateway-auth-policy"}

List gateway auth policies

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: List gateway auth policies for a (customer, project, gateway) scope.

Request fields:

Field	Required	Description
`customer_id`	no	undocumented
`project_id`	no	undocumented
`project_gateway_id`	no	undocumented

Response fields:

Field	Required	Description
`policies`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) ListGatewayAuthPolicies(ctx context.Context, req *adminv1.ListGatewayAuthPoliciesRequest) (*adminv1.ListGatewayAuthPoliciesResponse, error)","python":"list_gateway_auth_policies(req: gateway_auth_policy_pb2.ListGatewayAuthPoliciesRequest) -\u003e ListGatewayAuthPoliciesResponse","typescript":"listGatewayAuthPolicies(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.ListGatewayAuthPoliciesRequestSchema\u003e): Promise\u003cListGatewayAuthPoliciesResponse\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.ListGatewayAuthPoliciesRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().ListGatewayAuthPolicies(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/listgatewayauthpolicies\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.ListGatewayAuthPoliciesRequest()\ntry:\n    result = client.gateway_auth_policy.list_gateway_auth_policies(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.listGatewayAuthPolicies(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"GET","httpPath":"/admin/v1/gateway-auth-policies","slug":"list-gateway-auth-policies"}

Update gateway auth policy

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: Update a gateway auth policy's provider config + enabled flag.

Request fields:

Field	Required	Description
`id`	no	undocumented
`mechanism`	no	undocumented
`issuer`	no	undocumented
`jwks_uri`	no	undocumented
`jwks_inline`	no	undocumented
`audiences`	no	Replaces the stored list. A jwt policy must name at least one audience and at most 8, except that an update to a policy stored with no audience may keep naming none.
`extraction_header`	no	undocumented
`enabled`	no	Omitted preserves the stored value. The other provider fields below are a replace rather than a merge -- mechanism is required, so a caller always sends the whole provider block -- but enabled is a lifecycle flag with a column default, and flipping it off because a caller left it out is a different thing from clearing an audience list they did not send.
`required_scopes`	no	Replaces the stored list the way audiences does, so an update that omits it clears the requirement.
`environment_claim`	no	Name of the token claim carrying the environment the token was issued for (fraser#9288), validated as on create. Unlike the provider fields above, omitted preserves the stored value and an empty string clears it. That is because a client written before the field existed resends the provider block without it, and a replace would then drop the stored claim on every edit that client makes. A write leaving the policy enabled with this set is refused with FAILED_PRECONDITION while a live project gateway carrying the policy's project_gateway_id declares no environment.

Response fields:

Field	Required	Description
`policy`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) UpdateGatewayAuthPolicy(ctx context.Context, req *adminv1.UpdateGatewayAuthPolicyRequest) (*adminv1.UpdateGatewayAuthPolicyResponse, error)","python":"update_gateway_auth_policy(req: gateway_auth_policy_pb2.UpdateGatewayAuthPolicyRequest) -\u003e UpdateGatewayAuthPolicyResponse","typescript":"updateGatewayAuthPolicy(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.UpdateGatewayAuthPolicyRequestSchema\u003e): Promise\u003cUpdateGatewayAuthPolicyResponse\u003e","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"mechanism\": \"...\",\n    \"issuer\": \"...\",\n    \"jwks_uri\": \"...\",\n    \"jwks_inline\": {},\n    \"audiences\": [],\n    \"extraction_header\": \"...\",\n    \"enabled\": false,\n    \"required_scopes\": [],\n    \"environment_claim\": \"...\"\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.UpdateGatewayAuthPolicyRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().UpdateGatewayAuthPolicy(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/updategatewayauthpolicy\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.UpdateGatewayAuthPolicyRequest()\ntry:\n    result = client.gateway_auth_policy.update_gateway_auth_policy(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.updateGatewayAuthPolicy(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"mechanism\": \"...\",\n    \"issuer\": \"...\",\n    \"jwks_uri\": \"...\",\n    \"jwks_inline\": {},\n    \"audiences\": [],\n    \"extraction_header\": \"...\",\n    \"enabled\": false,\n    \"required_scopes\": [],\n    \"environment_claim\": \"...\"\n  }'"},"persona":"Admin","httpVerb":"PATCH","httpPath":"/admin/v1/gateway-auth-policies/{id}","slug":"update-gateway-auth-policy"}

Delete gateway auth policy

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: Delete (soft) a gateway auth policy.

Request fields:

Field	Required	Description
`id`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) DeleteGatewayAuthPolicy(ctx context.Context, req *adminv1.DeleteGatewayAuthPolicyRequest) (*adminv1.DeleteGatewayAuthPolicyResponse, error)","python":"delete_gateway_auth_policy(req: gateway_auth_policy_pb2.DeleteGatewayAuthPolicyRequest) -\u003e DeleteGatewayAuthPolicyResponse","typescript":"deleteGatewayAuthPolicy(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.DeleteGatewayAuthPolicyRequestSchema\u003e): Promise\u003cDeleteGatewayAuthPolicyResponse\u003e","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.DeleteGatewayAuthPolicyRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().DeleteGatewayAuthPolicy(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/deletegatewayauthpolicy\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.DeleteGatewayAuthPolicyRequest()\ntry:\n    result = client.gateway_auth_policy.delete_gateway_auth_policy(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.deleteGatewayAuthPolicy(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"DELETE","httpPath":"/admin/v1/gateway-auth-policies/{id}","slug":"delete-gateway-auth-policy"}

Create identity mapping rule

Changed in v0.7.0 (behaviour changes): Creating an identity mapping rule now refuses a jit_project_id that is not a project of the policy's customer or is not attached to the policy's gateway, a jit_principal_cap on a pre_registered rule, and a jit rule whose principal_type is not external.

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: Create an identity mapping rule under a policy.

Request fields:

Field	Required	Description
`policy_id`	no	undocumented
`claim_name`	no	undocumented
`claim_value_template`	no	Shell glob in the syntax of Go's path.Match that the claim value must match: "*" matches any run of characters other than "/", "?" one such character, and "[...]" a character class. Unset or empty matches every value, so a jit rule must set it unless match_every_claim_value is true.
`target`	no	"pre_registered" or "jit"; validated in valet.
`jit_project_id`	no	undocumented
`jit_principal_cap`	no	Most external principals the project of a jit rule may hold before the rule refuses a new identity. Unset on a jit rule stores 100. Refused on a pre_registered rule.
`principal_type`	no	undocumented
`match_every_claim_value`	no	Says that a jit rule with no claim_value_template creates a principal and an API key for every value of claim_name that a token from the policy's issuer carries. A jit rule with no template is refused unless this is true, a rule that sets both is refused, and a pre_registered rule that sets it is refused. The management plane does not store it, because a stored rule with no template already matches every value.

Response fields:

Field	Required	Description
`rule`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) CreateIdentityMappingRule(ctx context.Context, req *adminv1.CreateIdentityMappingRuleRequest) (*adminv1.CreateIdentityMappingRuleResponse, error)","python":"create_identity_mapping_rule(req: gateway_auth_policy_pb2.CreateIdentityMappingRuleRequest) -\u003e CreateIdentityMappingRuleResponse","typescript":"createIdentityMappingRule(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.CreateIdentityMappingRuleRequestSchema\u003e): Promise\u003cCreateIdentityMappingRuleResponse\u003e","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../rules\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"claim_name\": \"...\",\n    \"claim_value_template\": \"...\",\n    \"target\": \"...\",\n    \"jit_project_id\": \"...\",\n    \"jit_principal_cap\": 0,\n    \"principal_type\": \"...\",\n    \"match_every_claim_value\": false\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.CreateIdentityMappingRuleRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().CreateIdentityMappingRule(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/createidentitymappingrule\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.CreateIdentityMappingRuleRequest()\ntry:\n    result = client.gateway_auth_policy.create_identity_mapping_rule(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.createIdentityMappingRule(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../rules\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"claim_name\": \"...\",\n    \"claim_value_template\": \"...\",\n    \"target\": \"...\",\n    \"jit_project_id\": \"...\",\n    \"jit_principal_cap\": 0,\n    \"principal_type\": \"...\",\n    \"match_every_claim_value\": false\n  }'"},"persona":"Admin","httpVerb":"POST","httpPath":"/admin/v1/gateway-auth-policies/{policy_id}/rules","slug":"create-identity-mapping-rule"}

List identity mapping rules

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: List identity mapping rules for a policy.

Request fields:

Field	Required	Description
`policy_id`	no	undocumented

Response fields:

Field	Required	Description
`rules`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) ListIdentityMappingRules(ctx context.Context, req *adminv1.ListIdentityMappingRulesRequest) (*adminv1.ListIdentityMappingRulesResponse, error)","python":"list_identity_mapping_rules(req: gateway_auth_policy_pb2.ListIdentityMappingRulesRequest) -\u003e ListIdentityMappingRulesResponse","typescript":"listIdentityMappingRules(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.ListIdentityMappingRulesRequestSchema\u003e): Promise\u003cListIdentityMappingRulesResponse\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../rules\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.ListIdentityMappingRulesRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().ListIdentityMappingRules(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/listidentitymappingrules\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.ListIdentityMappingRulesRequest()\ntry:\n    result = client.gateway_auth_policy.list_identity_mapping_rules(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.listIdentityMappingRules(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../rules\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"GET","httpPath":"/admin/v1/gateway-auth-policies/{policy_id}/rules","slug":"list-identity-mapping-rules"}

Delete identity mapping rule

Changed in v0.6.0 (new features): The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

What it does: Delete an identity mapping rule.

Request fields:

Field	Required	Description
`id`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) DeleteIdentityMappingRule(ctx context.Context, req *adminv1.DeleteIdentityMappingRuleRequest) (*adminv1.DeleteIdentityMappingRuleResponse, error)","python":"delete_identity_mapping_rule(req: gateway_auth_policy_pb2.DeleteIdentityMappingRuleRequest) -\u003e DeleteIdentityMappingRuleResponse","typescript":"deleteIdentityMappingRule(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.DeleteIdentityMappingRuleRequestSchema\u003e): Promise\u003cDeleteIdentityMappingRuleResponse\u003e","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/admin/v1/identity-mapping-rules/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.DeleteIdentityMappingRuleRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().DeleteIdentityMappingRule(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/deleteidentitymappingrule\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.DeleteIdentityMappingRuleRequest()\ntry:\n    result = client.gateway_auth_policy.delete_identity_mapping_rule(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.deleteIdentityMappingRule(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/admin/v1/identity-mapping-rules/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"DELETE","httpPath":"/admin/v1/identity-mapping-rules/{id}","slug":"delete-identity-mapping-rule"}

Create claim project binding

Changed in v0.10.0 (new features): An application can leave out x-tars-project when its GatewayAuthPolicy binds a claim value to a project, and the data plane acts in that project. Calls matching no binding, bindings for two projects, or a bound project that is unserved or rejects tokens are refused with 403. When the data plane auth config passes its size cap and a policy's bindings are left out, such calls answer 503 bindings_unavailable until the bindings shrink or the caller sends x-tars-project.

What it does: Bind a claim value to a project under a policy. A token call that sends no x-tars-project acts in that project when the token the policy verified carries the value in the claim.

Request fields:

Field	Required	Description
`policy_id`	no	undocumented
`claim_name`	no	The token claim whose value selects the project. The data plane reads scope and scp as space-delimited lists, an array claim as its string elements, and any other string claim as one value. iss, aud, exp, nbf, iat and jti are refused.
`claim_value`	no	The value, compared exactly and case-sensitively. A value holding "*" is refused, because a binding names one value and is never a pattern, and a scope or scp value holding a space is refused, because the data plane splits those claims on spaces. A value holding a control character is refused, and the bindings of one policy together render at most 24 KiB in the PROXY config.
`bound_project_id`	no	The project the call acts in: a project of the policy's customer attached to the policy's project gateway. The field is named bound_project_id so the RPC stays a platform RPC whose request names no tenant.

Response fields:

Field	Required	Description
`binding`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) CreateClaimProjectBinding(ctx context.Context, req *adminv1.CreateClaimProjectBindingRequest) (*adminv1.CreateClaimProjectBindingResponse, error)","python":"create_claim_project_binding(req: gateway_auth_policy_pb2.CreateClaimProjectBindingRequest) -\u003e CreateClaimProjectBindingResponse","typescript":"createClaimProjectBinding(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.CreateClaimProjectBindingRequestSchema\u003e): Promise\u003cCreateClaimProjectBindingResponse\u003e","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../project-bindings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"claim_name\": \"...\",\n    \"claim_value\": \"...\",\n    \"bound_project_id\": \"...\"\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.CreateClaimProjectBindingRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().CreateClaimProjectBinding(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/createclaimprojectbinding\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.CreateClaimProjectBindingRequest()\ntry:\n    result = client.gateway_auth_policy.create_claim_project_binding(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.createClaimProjectBinding(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../project-bindings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"claim_name\": \"...\",\n    \"claim_value\": \"...\",\n    \"bound_project_id\": \"...\"\n  }'"},"persona":"Admin","httpVerb":"POST","httpPath":"/admin/v1/gateway-auth-policies/{policy_id}/project-bindings","slug":"create-claim-project-binding"}

List claim project bindings

What it does: List the claim-to-project bindings of a policy.

Request fields:

Field	Required	Description
`policy_id`	no	undocumented

Response fields:

Field	Required	Description
`bindings`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) ListClaimProjectBindings(ctx context.Context, req *adminv1.ListClaimProjectBindingsRequest) (*adminv1.ListClaimProjectBindingsResponse, error)","python":"list_claim_project_bindings(req: gateway_auth_policy_pb2.ListClaimProjectBindingsRequest) -\u003e ListClaimProjectBindingsResponse","typescript":"listClaimProjectBindings(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.ListClaimProjectBindingsRequestSchema\u003e): Promise\u003cListClaimProjectBindingsResponse\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../project-bindings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.ListClaimProjectBindingsRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().ListClaimProjectBindings(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/listclaimprojectbindings\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.ListClaimProjectBindingsRequest()\ntry:\n    result = client.gateway_auth_policy.list_claim_project_bindings(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.listClaimProjectBindings(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/gateway-auth-policies/01H.../project-bindings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"GET","httpPath":"/admin/v1/gateway-auth-policies/{policy_id}/project-bindings","slug":"list-claim-project-bindings"}

Delete claim project binding

What it does: Delete a claim-to-project binding.

Request fields:

Field	Required	Description
`id`	no	undocumented

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) DeleteClaimProjectBinding(ctx context.Context, req *adminv1.DeleteClaimProjectBindingRequest) (*adminv1.DeleteClaimProjectBindingResponse, error)","python":"delete_claim_project_binding(req: gateway_auth_policy_pb2.DeleteClaimProjectBindingRequest) -\u003e DeleteClaimProjectBindingResponse","typescript":"deleteClaimProjectBinding(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.DeleteClaimProjectBindingRequestSchema\u003e): Promise\u003cDeleteClaimProjectBindingResponse\u003e","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/admin/v1/claim-project-bindings/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.DeleteClaimProjectBindingRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().DeleteClaimProjectBinding(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/deleteclaimprojectbinding\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.DeleteClaimProjectBindingRequest()\ntry:\n    result = client.gateway_auth_policy.delete_claim_project_binding(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.deleteClaimProjectBinding(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/admin/v1/claim-project-bindings/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"DELETE","httpPath":"/admin/v1/claim-project-bindings/{id}","slug":"delete-claim-project-binding"}

Get private address settings

Changed in v0.11.0 (new features): An Organization's super_admin can now let the management plane accept an identity provider on a private network for that Organization alone, for gateway auth policy keys and for project OIDC contracts, without asking the deployment's operator. Each setting takes ALLOW, DENY or INHERIT, and the Organization's choice wins over the deployment's own setting. An admin API key cannot change either one.

What it does: Read one organization's private-address settings: whether the management plane accepts a gateway auth policy's jwks_uri, and a project OIDC contract's issuer and discovered jwks_uri, on a non-public address for that organization. INHERIT means the organization follows the deployment's own setting.

Request fields:

Field	Required	Description
`customer_id`	no	undocumented

Response fields:

Field	Required	Description
`gateway_auth_jwks`	no	Whether a gateway auth policy's jwks_uri may be on a non-public address. Never UNSPECIFIED.
`oidc_discovery`	no	Whether a project OIDC contract's discovery fetch may connect to a non-public address, and whether the jwks_uri it discovers may be on one. Never UNSPECIFIED.

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) GetPrivateAddressSettings(ctx context.Context, req *adminv1.GetPrivateAddressSettingsRequest) (*adminv1.GetPrivateAddressSettingsResponse, error)","python":"get_private_address_settings(req: gateway_auth_policy_pb2.GetPrivateAddressSettingsRequest) -\u003e GetPrivateAddressSettingsResponse","typescript":"getPrivateAddressSettings(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.GetPrivateAddressSettingsRequestSchema\u003e): Promise\u003cGetPrivateAddressSettingsResponse\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/customers/cust_01H.../private-address-settings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.GetPrivateAddressSettingsRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().GetPrivateAddressSettings(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/getprivateaddresssettings\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.GetPrivateAddressSettingsRequest()\ntry:\n    result = client.gateway_auth_policy.get_private_address_settings(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.getPrivateAddressSettings(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl \"${AGENTROUTER_BASE_URL}/admin/v1/customers/cust_01H.../private-address-settings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"App Developer (API key)","httpVerb":"GET","httpPath":"/admin/v1/customers/{customer_id}/private-address-settings","slug":"get-private-address-settings"}

Set private address settings

What it does: Change one organization's private-address settings. ALLOW lets the management plane accept a non-public address for that organization, DENY refuses one even while the deployment allows it, and INHERIT follows the deployment's own setting. A field left UNSPECIFIED keeps its stored value. The settings change what the management plane accepts only, so a data plane that fetches keys from a private address still needs its own environment variable. Refused with FAILED_PRECONDITION on SaaS.

Request fields:

Field	Required	Description
`customer_id`	no	undocumented
`gateway_auth_jwks`	no	The new gateway auth policy setting. UNSPECIFIED keeps the stored value.
`oidc_discovery`	no	The new project OIDC contract setting. UNSPECIFIED keeps the stored value. With ALLOW, the discovery fetch still refuses a loopback, link-local, unspecified, multicast or broadcast address, the cloud metadata addresses among them.

Response fields:

Field	Required	Description
`gateway_auth_jwks`	no	The gateway auth policy setting after the write. Never UNSPECIFIED.
`oidc_discovery`	no	The project OIDC contract setting after the write. Never UNSPECIFIED.

{"signatures":{"go":"func (x *GatewayAuthPolicyClient) SetPrivateAddressSettings(ctx context.Context, req *adminv1.SetPrivateAddressSettingsRequest) (*adminv1.SetPrivateAddressSettingsResponse, error)","python":"set_private_address_settings(req: gateway_auth_policy_pb2.SetPrivateAddressSettingsRequest) -\u003e SetPrivateAddressSettingsResponse","typescript":"setPrivateAddressSettings(req: MessageInitShape\u003ctypeof tars_admin_v1_gateway_auth_policy_pb.SetPrivateAddressSettingsRequestSchema\u003e): Promise\u003cSetPrivateAddressSettingsResponse\u003e","curl":"curl -X PUT \"${AGENTROUTER_BASE_URL}/admin/v1/customers/cust_01H.../private-address-settings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"gateway_auth_jwks\": \"...\",\n    \"oidc_discovery\": \"...\"\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tadminv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026adminv1.SetPrivateAddressSettingsRequest{}\n\n\tresp, err := client.GatewayAuthPolicy().SetPrivateAddressSettings(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/gatewayauthpolicy/setprivateaddresssettings\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.admin.v1 import gateway_auth_policy_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = gateway_auth_policy_pb2.SetPrivateAddressSettingsRequest()\ntry:\n    result = client.gateway_auth_policy.set_private_address_settings(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.gatewayAuthPolicy.setPrivateAddressSettings(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"gatewayauthpolicy\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X PUT \"${AGENTROUTER_BASE_URL}/admin/v1/customers/cust_01H.../private-address-settings\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"gateway_auth_jwks\": \"...\",\n    \"oidc_discovery\": \"...\"\n  }'"},"persona":"App Developer (API key)","httpVerb":"PUT","httpPath":"/admin/v1/customers/{customer_id}/private-address-settings","slug":"set-private-address-settings"}