# Layer7 API Portal — Policy Template Bundles

This folder contains a collection of example **policy template bundles** that can be imported into the Layer7 API Gateway for viewing and modification to meet your needs. They may be used with the **Layer7 API Developer Portal** by directly importing them via the Manage->Gateway Bundles menu (NOTE: these are examples and must be reviewed prior to any production use). Each bundle ships a ready-to-use encapsulated assertion (and its backing policy fragment) that implements a common Portal-aware concern — authentication, routing, traffic management, etc. — so that API publishers can drop the template into their APIs without re-inventing the logic.

> **For more information on working with policy templates**, refer to the [`Layer7 API Developer Portal Policy Templates Guide.md`](./Layer7%20API%20Developer%20Portal%20Policy%20Templates%20Guide.md) in this folder. That guide is the authoritative reference for how Portal policy templates are designed, built, packaged, deployed, and referenced from an API, and should be consulted before authoring or modifying any of the bundles below.

## How to use these bundles

1. Import the desired `*.json` bundle into your Layer7 API Gateway (Web Based Policy Manager → *Import Graphman Bundle*, or via the [Graphman Client](https://github.com/Layer7-Community/graphman-client)).
2. Each bundle installs:
   - A **policy fragment** under `/Portal Templates/`.
   - An **encapsulated assertion** that wraps the fragment and exposes it to Portal-managed services.
3. View and modify the policy as needed to meet your needs.
4. Export the final bundle that you wish to use so that it may be imported into the API Portal.

## Folder summary

| Folder | Description |
| --- | --- |
| [`Authentication/`](./Authentication) | Template bundles that authenticate the caller against a Portal-managed API. Includes API key (header/query), API key + secret (HTTP Basic, with hashed-secret support), OAuth 2.0 access-token, **JWT bearer-token** (validated against gateway-stored recipient keys; suitable for external IdPs such as Okta, Azure AD, Auth0, AWS Cognito), and mutual-TLS (client certificate) variants. |
| [`DropDown/`](./DropDown) | Template bundles that demonstrate the Portal **drop-down selection field** capability — the `l7.enum.<name>` / `l7.enum.<name>.<value>` argument-naming convention that turns a free-form template input into a drop-down menu in the Portal UI. Useful as a starting point for any template that needs the publisher to choose from a fixed set of options (e.g. environment, region, plan tier). |
| [`RateQuota/`](./RateQuota) | Template bundles that enforce **rate limit and quota** beyond what the Portal's Standard Rate-Quota system templates currently cover. Currently includes `OrgLevelRLQ-1.0.0.json`, which enforces per-**Organization** rate/quota (formerly known as **Account Plan**) by including the auto-generated Account Plans Fragment and short-circuiting with `503` if the limit is exceeded. Intended to run after an API-key-lookup template (e.g. `APIKeyValidation-1.0`) when the Portal's Standard system templates are not in use. |
| [`RequestValidation/`](./RequestValidation) | Template bundles that validate an incoming API request before it reaches the backend. Currently includes `ValidateOpenAPISample-1.0.0.json`, which uses the **Validate Against OpenAPI Document** assertion to validate requests against the Portal-published spec in `service.property.internal.apiSpec`, with a Validation-Profile drop-down (`path` / `path_and_method` / `request` / `request_strict`) that exercises every option on the assertion (path, method, headers, query parameters, body, security credentials, strict mode). |
| [`Routing/`](./Routing) | Template bundles that demonstrate Portal-aware routing patterns. Currently includes `RouteRequest-1.0.0.json`, which performs the **Route via HTTP** assertion against an `apiLocation` argument, strips the API's `serviceUrl` prefix from the request URI, and exports routing-outcome variables (`override_template_routing`, `portal.analytics.response.code`) for a parent template to consume. |
| [`SecretFields/`](./SecretFields) | Template bundles that demonstrate the Portal **secure secret field** capability — the `l7.secure.<name>` argument-naming convention that masks the publisher's input in the UI, stores the value as a Gateway encrypted stored-password, and exposes it inside the fragment via `${l7.secure.<name>}`. Useful as a starting point for any template that needs the publisher to supply credentials, API keys, or other sensitive values (e.g. backend service username/password, signing secrets). |
| [`ThreatProtection/`](./ThreatProtection) | Template bundles that drop oversized, malformed, or obviously malicious requests at the edge — the **Threat Protection** category called out in the guide, intended to run **first** in any Policy Template Category chain. Currently includes `ThreatProtection-1.0.0.json`, which layers `Limit Message Size`, `Protect Against SQL Attacks`, `Protect Against Cross-Site Scripting`, `Protect Against Code Injection`, and content-type-aware `Protect Against JSON / XML Document Structure Threats` into a single composable template, with conservative defaults tuned to keep false positives low and JSON-formatted error responses on rejection. |


## More information

For comprehensive guidance on the Portal policy template framework — including template structure, lifecycle, version compatibility, and best practices for authoring your own templates — refer to the [`Layer7 API Developer Portal Policy Templates Guide.md`](./Layer7%20API%20Developer%20Portal%20Policy%20Templates%20Guide.md) located in this folder.

## License & support

These bundles are provided as community samples. Review and adapt the policy logic to match your organization's security, compliance, and operational requirements before deploying to production.