Import OpenAPI Spec
Generate request-body validation rules from an OpenAPI 3 specification — one validate-body rule per operation that declares a JSON request body, scoped to that method + path. This turns your API contract into edge enforcement with no hand-authoring.
Two steps: /preview is a dry run (no writes) that returns the exact plan — the rules that would be created, the operations skipped and why, and a plan_hash. /import is the only writer: it re-parses the same spec, re-verifies the plan_hash (a TOCTOU guard), and atomically materializes a single managed policy named openapi-import. Re-importing replaces that policy's rules (a removed operation removes its rule; nothing is duplicated); your hand-made policies are never touched.
Safe by default. Generated rules are created staged (disabled) in detect mode — an import can never start blocking live traffic until you re-import with mode: "enforce". Upload or paste only — there is deliberately no spec_url field (a server-side fetch would be an SSRF vector), and any external $ref in the document is refused. The spec is capped at 2 MiB, parsed under an 8 s deadline, and limited to 500 operations.
Path parameters
Request body
Send the spec as multipart/form-data (file field spec) or as JSON. JSON fields:
detect (default — rules created disabled/staged) or enforce (rules created enabled)./api/v1) prepended to every generated route matcher.custom-response 404 rule that blocks any path/method not in the spec (opt-in; only when it fits the expression size limit)."METHOD /path") to skip.plan_hash from a prior /preview; a mismatch returns 409 (the spec changed — re-preview).Responses
/preview: the plan (rules, skipped, operation_count, plan_hash). /import: {policy_id, rules_created, rules_deleted, mode, plan_hash}./import: plan_hash mismatch — the spec changed since preview.$ref, or exceeded the operation cap. Nothing is written.# 1) dry-run preview (paste JSON spec)
curl -sX POST https://api.ngris.com/v1/endpoints/$UUID/policies/import-openapi/preview \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-d '{"spec_text": "'"$(cat openapi.json | jq -Rs .)"'", "mode": "detect"}'
# → { "rules": [{"method":"POST","path":"/orders"}...],
# "skipped": [...], "operation_count": 12, "plan_hash": "9f2c…" }
# 2) apply (staged/disabled in detect mode), echoing the plan_hash
curl -sX POST https://api.ngris.com/v1/endpoints/$UUID/policies/import-openapi \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-d '{"spec_text": "…", "mode": "detect", "plan_hash": "9f2c…"}'
# → { "policy_id": 42, "rules_created": 8, "rules_deleted": 0, "mode": "detect" }curl -sX POST https://api.ngris.com/v1/endpoints/$UUID/policies/import-openapi/preview \
-H "Authorization: Bearer $TOKEN" \
-F spec=@openapi.yaml -F mode=detect