Ingress guards
The config blocks that admit or refuse a request before its workflow runs.
| Page | Holds |
|---|---|
auth | the api_key, hmac and jwt modes, every field each takes, the webhook presets, and the rules a failure and a rotation follow. |
rate_limit | the token bucket, the key_logic context and key_headers, cross-ingress semantics, and cluster-wide enforcement. |
principal_rate_limit | a quota keyed on the verified JWT claims, applied after authentication on top of the address-keyed rate_limit. |
backpressure | a per-node concurrency permit shared by every ingress, with excess shed as 503 rather than queued. |
deduplication | idempotency-key replay protection within a window, the backing store, and how Kafka and cluster mode behave. |
validation_logic | a JSONLogic predicate over data and metadata that rejects a request with 400 before its workflow runs. |
origin_allow_list | a server-side Origin header check on the HTTP ingresses, and how it differs from the platform CORS layer. |
Related
- Channel configuration: every key, with its page.
- Guards by ingress: which guard runs where, and in what order.
- Configure a channel: the same keys, as a walkthrough.
Last verified 14 September 2026