Support "other" and "none" upstream auth types for LLM Providers and proxies

docs/rest-apis/gateway/README.md

@@ -98,34 +98,5 @@ Base URLs:
 - [Update a secret](secrets-management.md#update-a-secret)
 - [Delete a secret](secrets-management.md#delete-a-secret)
 
-### [WebSub API Management](websub-api-management.md)
-
-- [Create a new WebSubAPI](websub-api-management.md#create-a-new-websubapi)
-- [List all WebSubAPIs](websub-api-management.md#list-all-websubapis)
-- [Create a new API key for a WebSub API](websub-api-management.md#create-a-new-api-key-for-a-websub-api)
-- [Get the list of API keys for a WebSub API](websub-api-management.md#get-the-list-of-api-keys-for-a-websub-api)
-- [Regenerate API key for a WebSub API](websub-api-management.md#regenerate-api-key-for-a-websub-api)
-- [Update an API key for a WebSub API](websub-api-management.md#update-an-api-key-for-a-websub-api)
-- [Revoke an API key for a WebSub API](websub-api-management.md#revoke-an-api-key-for-a-websub-api)
-- [Generate a new HMAC secret for a WebSub API](websub-api-management.md#generate-a-new-hmac-secret-for-a-websub-api)
-- [List HMAC secrets for a WebSub API](websub-api-management.md#list-hmac-secrets-for-a-websub-api)
-- [Regenerate (rotate) a WebSub API HMAC secret](websub-api-management.md#regenerate-rotate-a-websub-api-hmac-secret)
-- [Delete a WebSub API HMAC secret](websub-api-management.md#delete-a-websub-api-hmac-secret)
-- [Get WebSubAPI by id](websub-api-management.md#get-websubapi-by-id)
-- [Update an existing WebSubAPI](websub-api-management.md#update-an-existing-websubapi)
-- [Delete a WebSubAPI](websub-api-management.md#delete-a-websubapi)
-
-### [WebBroker API Management](webbroker-api-management.md)
-
-- [Create a new WebBrokerAPI](webbroker-api-management.md#create-a-new-webbrokerapi)
-- [List all WebBrokerAPIs](webbroker-api-management.md#list-all-webbrokerapis)
-- [Get WebBrokerAPI by id](webbroker-api-management.md#get-webbrokerapi-by-id)
-- [Delete a WebBrokerAPI](webbroker-api-management.md#delete-a-webbrokerapi)
-- [Create a new API key for a WebBroker API](webbroker-api-management.md#create-a-new-api-key-for-a-webbroker-api)
-- [Get the list of API keys for a WebBroker API](webbroker-api-management.md#get-the-list-of-api-keys-for-a-webbroker-api)
-- [Regenerate API key for a WebBroker API](webbroker-api-management.md#regenerate-api-key-for-a-webbroker-api)
-- [Update an API key for a WebBroker API](webbroker-api-management.md#update-an-api-key-for-a-webbroker-api)
-- [Revoke an API key for a WebBroker API](webbroker-api-management.md#revoke-an-api-key-for-a-webbroker-api)
-
 ### [Schemas](schemas.md)
 

docs/rest-apis/gateway/llm-provider-management.md

@@ -297,6 +297,14 @@ Status Code **200**
 |»»»» context|string|false|none|Base path for all API routes (must start with /, no trailing slash)|
 |»»»» vhost|string|false|none|Virtual host name used for routing. Supports standard domain names, subdomains, or wildcard domains. Must follow RFC-compliant hostname rules. Wildcards are only allowed in the left-most label (e.g., *.example.com).|
 |»»»» template|string|true|none|Template name to use for this LLM Provider|
+|»»»» upstreamDefinitions|[[UpstreamDefinition](schemas.md#schemaupstreamdefinition)]|false|none|List of reusable upstream definitions with optional timeout configurations. Referenced by upstream.ref.|
+|»»»»» name|string|true|none|Unique identifier for this upstream definition|
+|»»»»» basePath|string|false|none|Base path prefix for all endpoints in this upstream (e.g., /api/v2). All requests to this upstream will have this path prepended. Must start with '/' and must not end with '/'; omit for root.|
+|»»»»» timeout|[UpstreamTimeout](schemas.md#schemaupstreamtimeout)|false|none|Timeout configuration for upstream requests|
+|»»»»»» connect|string|false|none|Connection timeout duration (e.g., "5s", "500ms")|
+|»»»»» upstreams|[object]|true|none|List of backend targets with optional weights for load balancing|
+|»»»»»» url|string(uri)|true|none|Backend URL (host and port only, path comes from basePath)|
+|»»»»»» weight|integer|false|none|Relative weight for load balancing across multiple upstream targets. Reserved for future multi-target load balancing; not applied yet (only the first target is currently used).|
 |»»»» upstream|any|true|none|none|
 
 *allOf*
@@ -360,6 +368,9 @@ Status Code **200**
 |»»»»»» methods|[string]|true|none|none|
 |»»»»»» params|object|true|none|JSON Schema describing the parameters accepted by this policy. This itself is a JSON Schema document.|
 |»»»» deploymentState|string|false|none|Desired deployment state - 'deployed' (default) or 'undeployed'. When set to 'undeployed', the LLM Provider is removed from router traffic but configuration and policies are preserved for potential redeployment.|
+|»»»» resilience|[Resilience](schemas.md#schemaresilience)|false|none|Backend/route timeout configuration. Maps to Envoy RouteAction timeouts. Can be set at the API level (applies to all routes) and/or the operation level (applies to that operation's route). When set at both levels, the operation-level value takes precedence. When unset, the gateway's global route timeout defaults apply.|
+|»»»»» timeout|string|false|none|Maximum time for the entire route (request to upstream response). "0s" disables the timeout.|
+|»»»»» idleTimeout|string|false|none|Per-route stream idle timeout (overrides the listener stream idle timeout for this route). "0s" disables the timeout.|
 
 *and*
 
@@ -382,6 +393,8 @@ Status Code **200**
 |hostRewrite|auto|
 |hostRewrite|manual|
 |type|api-key|
+|type|other|
+|type|none|
 |mode|allow_all|
 |mode|deny_all|
 |deploymentState|deployed|

docs/rest-apis/gateway/llm-proxy-management.md

@@ -231,6 +231,14 @@ Status Code **200**
 |»»»»»» path|string|true|none|none|
 |»»»»»» methods|[string]|true|none|none|
 |»»»»»» params|object|true|none|JSON Schema describing the parameters accepted by this policy. This itself is a JSON Schema document.|
+|»»»» additionalProviders|[[LLMProxyAdditionalProvider](schemas.md#schemallmproxyadditionalprovider)]|false|none|Optional list of additional LLM providers attached to this proxy as selectable upstreams. Policies (e.g. an OpenAI translator) can route requests to any of these by setting the upstream name. The primary `provider` field above remains the default upstream and the FK target.|
+|»»»»» id|string|true|none|Unique id of a deployed llm provider|
+|»»»»» as|string|false|none|Logical LLM Provider name used by policies to select this provider. Must be unique within the proxy. Defaults to `id` when omitted.|
+|»»»»» auth|[LLMUpstreamAuth](schemas.md#schemallmupstreamauth)|false|none|none|
+|»»»»» transformer|[LLMProxyTransformer](schemas.md#schemallmproxytransformer)|false|none|Request/response translator applied when this provider is the selected upstream. The proxy injects the translator as a conditional policy whose execution condition matches this provider, so it runs only when the provider is selected. The provider's `as` name (defaults to `id`) is passed to the translator as its target upstream.|
+|»»»»»» type|string|true|none|Translator policy name (for example openai-to-anthropic).|
+|»»»»»» version|string|true|none|Major-only translator policy version (for example v1). The Gateway Controller resolves it to the installed full version.|
+|»»»»»» params|object|false|none|Translator-specific parameters (for example model, apiVersion).|
 |»»»» policies|[[LLMPolicy](schemas.md#schemallmpolicy)]|false|none|DEPRECATED - use operationPolicies. Still honoured (treated identically to operationPolicies).|
 |»»»»» name|string|true|none|none|
 |»»»»» version|string|true|none|none|
@@ -239,6 +247,9 @@ Status Code **200**
 |»»»»»» methods|[string]|true|none|none|
 |»»»»»» params|object|true|none|JSON Schema describing the parameters accepted by this policy. This itself is a JSON Schema document.|
 |»»»» deploymentState|string|false|none|Desired deployment state - 'deployed' (default) or 'undeployed'. When set to 'undeployed', the LLM Proxy is removed from router traffic but configuration and policies are preserved for potential redeployment.|
+|»»»» resilience|[Resilience](schemas.md#schemaresilience)|false|none|Backend/route timeout configuration. Maps to Envoy RouteAction timeouts. Can be set at the API level (applies to all routes) and/or the operation level (applies to that operation's route). When set at both levels, the operation-level value takes precedence. When unset, the gateway's global route timeout defaults apply.|
+|»»»»» timeout|string|false|none|Maximum time for the entire route (request to upstream response). "0s" disables the timeout.|
+|»»»»» idleTimeout|string|false|none|Per-route stream idle timeout (overrides the listener stream idle timeout for this route). "0s" disables the timeout.|
 
 *and*
 
@@ -259,6 +270,8 @@ Status Code **200**
 |apiVersion|gateway.api-platform.wso2.com/v1|
 |kind|LlmProxy|
 |type|api-key|
+|type|other|
+|type|none|
 |deploymentState|deployed|
 |deploymentState|undeployed|
 |state|deployed|

docs/rest-apis/gateway/mcp-proxy-management.md

@@ -221,6 +221,14 @@ Status Code **200**
 |»»»» context|string|false|none|MCP Proxy context path|
 |»»»» specVersion|string|false|none|MCP specification version|
 |»»»» vhost|string|false|none|Virtual host name used for routing. Supports standard domain names, subdomains, or wildcard domains. Must follow RFC-compliant hostname rules. Wildcards are only allowed in the left-most label (e.g., *.example.com).|
+|»»»» upstreamDefinitions|[[UpstreamDefinition](schemas.md#schemaupstreamdefinition)]|false|none|List of reusable upstream definitions with optional timeout configurations. Referenced by upstream.ref.|
+|»»»»» name|string|true|none|Unique identifier for this upstream definition|
+|»»»»» basePath|string|false|none|Base path prefix for all endpoints in this upstream (e.g., /api/v2). All requests to this upstream will have this path prepended. Must start with '/' and must not end with '/'; omit for root.|
+|»»»»» timeout|[UpstreamTimeout](schemas.md#schemaupstreamtimeout)|false|none|Timeout configuration for upstream requests|
+|»»»»»» connect|string|false|none|Connection timeout duration (e.g., "5s", "500ms")|
+|»»»»» upstreams|[object]|true|none|List of backend targets with optional weights for load balancing|
+|»»»»»» url|string(uri)|true|none|Backend URL (host and port only, path comes from basePath)|
+|»»»»»» weight|integer|false|none|Relative weight for load balancing across multiple upstream targets. Reserved for future multi-target load balancing; not applied yet (only the first target is currently used).|
 |»»»» upstream|any|true|none|The backend MCP server url and auth configurations|
 
 *allOf*
@@ -286,6 +294,9 @@ Status Code **200**
 |»»»»»» required|boolean|false|none|Whether the argument is required|
 |»»»»»» title|string|false|none|Optional human-readable title of the argument|
 |»»»» deploymentState|string|false|none|Desired deployment state - 'deployed' (default) or 'undeployed'. When set to 'undeployed', the MCP Proxy is removed from router traffic but configuration and policies are preserved for potential redeployment.|
+|»»»» resilience|[Resilience](schemas.md#schemaresilience)|false|none|Backend/route timeout configuration. Maps to Envoy RouteAction timeouts. Can be set at the API level (applies to all routes) and/or the operation level (applies to that operation's route). When set at both levels, the operation-level value takes precedence. When unset, the gateway's global route timeout defaults apply.|
+|»»»»» timeout|string|false|none|Maximum time for the entire route (request to upstream response). "0s" disables the timeout.|
+|»»»»» idleTimeout|string|false|none|Per-route stream idle timeout (overrides the listener stream idle timeout for this route). "0s" disables the timeout.|
 
 *and*
 
@@ -308,6 +319,8 @@ Status Code **200**
 |hostRewrite|auto|
 |hostRewrite|manual|
 |type|api-key|
+|type|other|
+|type|none|
 |deploymentState|deployed|
 |deploymentState|undeployed|
 |state|deployed|

docs/rest-apis/gateway/rest-api-management.md

@@ -353,12 +353,12 @@ Status Code **200**
 |»»»» context|string|true|none|Base path for all API routes (must start with /, no trailing slash). Use $version to embed the version in the path (e.g., /reading-list/$version resolves to /reading-list/v1.0).|
 |»»»» upstreamDefinitions|[[UpstreamDefinition](schemas.md#schemaupstreamdefinition)]|false|none|List of reusable upstream definitions with optional timeout configurations|
 |»»»»» name|string|true|none|Unique identifier for this upstream definition|
-|»»»»» basePath|string|false|none|Base path prefix for all endpoints in this upstream (e.g., /api/v2). All requests to this upstream will have this path prepended.|
+|»»»»» basePath|string|false|none|Base path prefix for all endpoints in this upstream (e.g., /api/v2). All requests to this upstream will have this path prepended. Must start with '/' and must not end with '/'; omit for root.|
 |»»»»» timeout|[UpstreamTimeout](schemas.md#schemaupstreamtimeout)|false|none|Timeout configuration for upstream requests|
 |»»»»»» connect|string|false|none|Connection timeout duration (e.g., "5s", "500ms")|
 |»»»»» upstreams|[object]|true|none|List of backend targets with optional weights for load balancing|
 |»»»»»» url|string(uri)|true|none|Backend URL (host and port only, path comes from basePath)|
-|»»»»»» weight|integer|false|none|Weight for load balancing (optional, default 100)|
+|»»»»»» weight|integer|false|none|Relative weight for load balancing across multiple upstream targets. Reserved for future multi-target load balancing; not applied yet (only the first target is currently used).|
 |»»»» upstream|object|true|none|API-level upstream configuration|
 |»»»»» main|[Upstream](schemas.md#schemaupstream)|true|none|Upstream backend configuration (single target or reference)|
 |»»»»»» url|string(uri)|false|none|Direct backend URL to route traffic to|
@@ -383,18 +383,31 @@ Status Code **200**
 |---|---|---|---|---|
 |»»»»» sandbox|[Upstream](schemas.md#schemaupstream)|false|none|Upstream backend configuration (single target or reference)|
 |»»»» vhosts|object|false|none|Custom virtual hosts/domains for the API|
-|»»»»» main|string|true|none|Custom virtual host/domain for production traffic|
+|»»»»» main|string|true|none|Custom virtual host(s)/domain(s) for production traffic. One or more hostnames<br>separated by ';' — each hostname serves the main upstream (e.g. when a Gateway API<br>HTTPRoute attaches to multiple listener hostnames). The first entry is the primary<br>vhost. Each hostname may be a wildcard such as *.example.com.|
 |»»»»» sandbox|string|false|none|Custom virtual host/domain for sandbox traffic|
 |»»»» subscriptionPlans|[string]|false|none|List of subscription plan names available for this API|
 |»»»» policies|[[Policy](schemas.md#schemapolicy)]|false|none|List of API-level policies applied to all operations unless overridden|
 |»»»»» name|string|true|none|Name of the policy|
 |»»»»» version|string|true|none|Version of the policy. Only major-only version is allowed (e.g., v0, v1). Full semantic version (e.g., v1.0.0) is not accepted and will be rejected. The Gateway Controller resolves the major version to the single matching full version installed in the gateway image.|
 |»»»»» executionCondition|string|false|none|Expression controlling conditional execution of the policy|
 |»»»»» params|object|false|none|Arbitrary parameters for the policy (free-form key/value structure)|
+|»»»» resilience|[Resilience](schemas.md#schemaresilience)|false|none|Backend/route timeout configuration. Maps to Envoy RouteAction timeouts. Can be set at the API level (applies to all routes) and/or the operation level (applies to that operation's route). When set at both levels, the operation-level value takes precedence. When unset, the gateway's global route timeout defaults apply.|
+|»»»»» timeout|string|false|none|Maximum time for the entire route (request to upstream response). "0s" disables the timeout.|
+|»»»»» idleTimeout|string|false|none|Per-route stream idle timeout (overrides the listener stream idle timeout for this route). "0s" disables the timeout.|
 |»»»» operations|[[Operation](schemas.md#schemaoperation)]|true|none|List of HTTP operations/routes|
-|»»»»» method|string|true|none|HTTP method|
-|»»»»» path|string|true|none|Route path with optional {param} placeholders|
+|»»»»» method|[OperationMethod](schemas.md#schemaoperationmethod)|false|none|HTTP method (simple form; ignored when 'match' is set)|
+|»»»»» path|string|false|none|Route path with optional {param} placeholders (simple form; ignored when 'match' is set)|
+|»»»»» match|[OperationMatch](schemas.md#schemaoperationmatch)|false|none|Request matching criteria for an operation. Extensible with query params, cookies, etc.|
+|»»»»»» method|[OperationMethod](schemas.md#schemaoperationmethod)|true|none|HTTP method|
+|»»»»»» path|[OperationPathMatch](schemas.md#schemaoperationpathmatch)|true|none|none|
+|»»»»»»» value|string|true|none|Route path with optional {param} placeholders|
+|»»»»»»» type|string|false|none|Path matching semantics for the operation route|
+|»»»»»» headers|[[OperationHeaderMatch](schemas.md#schemaoperationheadermatch)]|false|none|Header matchers ANDed with the path match for Envoy route selection|
+|»»»»»»» name|string|true|none|Header name (case-insensitive)|
+|»»»»»»» value|string|true|none|Header value to match|
+|»»»»»»» type|string|false|none|Header match type|
 |»»»»» policies|[[Policy](schemas.md#schemapolicy)]|false|none|List of policies applied only to this operation (overrides or adds to API-level policies)|
+|»»»»» resilience|[Resilience](schemas.md#schemaresilience)|false|none|Backend/route timeout configuration. Maps to Envoy RouteAction timeouts. Can be set at the API level (applies to all routes) and/or the operation level (applies to that operation's route). When set at both levels, the operation-level value takes precedence. When unset, the gateway's global route timeout defaults apply.|
 |»»»» deploymentState|string|false|none|Desired deployment state - 'deployed' (default) or 'undeployed'. When set to 'undeployed', the API is removed from router traffic but configuration, API keys, and policies are preserved for potential redeployment.|
 
 *and*
@@ -424,6 +437,17 @@ Status Code **200**
 |method|PATCH|
 |method|HEAD|
 |method|OPTIONS|
+|method|GET|
+|method|POST|
+|method|PUT|
+|method|DELETE|
+|method|PATCH|
+|method|HEAD|
+|method|OPTIONS|
+|type|Exact|
+|type|PathPrefix|
+|type|Exact|
+|type|RegularExpression|
 |deploymentState|deployed|
 |deploymentState|undeployed|
 |state|deployed|