{
  "encassConfigs": [
    {
      "goid": "c9d0e1f299994aaa9bbbccccddddeeee",
      "guid": "c9d0e1f2-9999-4aaa-9bbb-ccccddddeeee",
      "name": "ValidateXMLSchema-1.0",
      "description": "Validates the request body against a publisher-supplied XML Schema (XSD) using the Layer7 'Validate Against Schema' assertion. The schema is provided as a Portal input and applied via the assertion's Configure-in-advance source (staticResourceInfo). On a validation failure the fragment captures the assertion's ${schema.failure} variable, returns 400 with a JSON error body, sets portal.analytics.response.code to 400, and exports the analytics + errorMsg variables. Suitable for SOAP and non-SOAP XML APIs - ApplyToArguments=false targets the entire message; switch to BODY or ARGUMENTS for SOAP envelope-level or RPC-style validation. Recommended placement: AFTER threat protection (so XML document-structure threats are dropped first) and BEFORE rate-quota / routing.",
      "policyName": "ValidateXMLSchema-1.0",
      "encassArgs": [
        {
          "name": "portal.managed.service.apiId",
          "type": "STRING",
          "ordinal": 1,
          "guiPrompt": false
        },
        {
          "name": "schema",
          "type": "STRING",
          "ordinal": 2,
          "guiPrompt": true,
          "guiLabel": "XML Schema (XSD) *"
        }
      ],
      "encassResults": [
        {
          "name": "errorMsg",
          "type": "STRING"
        },
        {
          "name": "portal.analytics.action",
          "type": "STRING"
        },
        {
          "name": "portal.analytics.api.uuid",
          "type": "STRING"
        },
        {
          "name": "portal.analytics.response.code",
          "type": "STRING"
        }
      ],
      "properties": [
        {
          "name": "allowTracing",
          "value": "false"
        },
        {
          "name": "paletteFolder",
          "value": "customAssertions"
        },
        {
          "name": "passMetricsToParent",
          "value": "false"
        }
      ]
    }
  ],
  "policies": [
    {
      "goid": "d0e1f2a3aaaa4bbb9cccddddeeeeffff",
      "guid": "d0e1f2a3-aaaa-4bbb-9ccc-ddddeeeeffff",
      "name": "ValidateXMLSchema-1.0",
      "policyType": "FRAGMENT",
      "enabled": true,
      "folderPath": "/Portal Templates",
      "soap": false,
      "policy": {
        "xml": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<wsp:Policy xmlns:L7p=\"http://www.layer7tech.com/ws/policy\" xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2002/12/policy\">\n    <wsp:All wsp:Usage=\"Required\">\n        <L7p:CommentAssertion>\n            <L7p:Comment stringValue=\"ValidateXMLSchema-1.0 - validate request body against the publisher-supplied schema. Returns 400 with a JSON error body on failure.\"/>\n        </L7p:CommentAssertion>\n        <L7p:CommentAssertion>\n            <L7p:Comment stringValue=\"Step 1: initialise analytics + working variables.\"/>\n        </L7p:CommentAssertion>\n        <L7p:SetVariable>\n            <L7p:Base64Expression stringValue=\"JHtyZXF1ZXN0Lmh0dHAudXJpfQ==\"/>\n            <L7p:VariableToSet stringValue=\"portal.analytics.action\"/>\n        </L7p:SetVariable>\n        <L7p:SetVariable>\n            <L7p:Base64Expression stringValue=\"JHtwb3J0YWwubWFuYWdlZC5zZXJ2aWNlLmFwaUlkfQ==\"/>\n            <L7p:VariableToSet stringValue=\"portal.analytics.api.uuid\"/>\n        </L7p:SetVariable>\n        <L7p:SetVariable>\n            <L7p:Base64Expression stringValue=\"\"/>\n            <L7p:VariableToSet stringValue=\"errorMsg\"/>\n        </L7p:SetVariable>\n        <L7p:CommentAssertion>\n            <L7p:Comment stringValue=\"Step 2: run the validation assertion. The schema is supplied as a context variable (${schema}) so publishers can paste an inline schema. To switch to URL-based schema retrieval, replace &lt;L7p:ResourceInfo staticResourceInfo=...&gt; with &lt;L7p:ResourceInfo singleUrlResourceInfo=&quot;included&quot;&gt;&lt;L7p:Url stringValue=&quot;...&quot;/&gt;&lt;/L7p:ResourceInfo&gt; and add a publisher input for the URL.\"/>\n        </L7p:CommentAssertion>\n        <wsp:OneOrMore wsp:Usage=\"Required\">\n            <L7p:SchemaValidation>\n                <L7p:ResourceInfo staticResourceInfo=\"included\">\n                    <L7p:Document stringValue=\"${schema}\"/>\n                </L7p:ResourceInfo>\n                <L7p:Target target=\"REQUEST\"/>\n                <L7p:ApplyToArguments booleanValue=\"false\"/>\n            </L7p:SchemaValidation>\n            <wsp:All wsp:Usage=\"Required\">\n                <L7p:SetVariable>\n                    <L7p:Base64Expression stringValue=\"NDAw\"/>\n                    <L7p:VariableToSet stringValue=\"portal.analytics.response.code\"/>\n                </L7p:SetVariable>\n                <L7p:SetVariable>\n                    <L7p:Base64Expression stringValue=\"UmVxdWVzdCBib2R5IGZhaWxlZCBYTUwgU2NoZW1hIHZhbGlkYXRpb246ICR7c2NoZW1hLmZhaWx1cmV9\"/>\n                    <L7p:VariableToSet stringValue=\"errorMsg\"/>\n                </L7p:SetVariable>\n            </wsp:All>\n        </wsp:OneOrMore>\n        <L7p:CommentAssertion>\n            <L7p:Comment stringValue=\"Step 3: export analytics + error variables for downstream templates / global analytics policy.\"/>\n        </L7p:CommentAssertion>\n        <L7p:ExportVariables>\n            <L7p:ExportedVars stringArrayValue=\"included\">\n                <L7p:item stringValue=\"errorMsg\"/>\n                <L7p:item stringValue=\"portal.analytics.action\"/>\n                <L7p:item stringValue=\"portal.analytics.api.uuid\"/>\n                <L7p:item stringValue=\"portal.analytics.response.code\"/>\n            </L7p:ExportedVars>\n        </L7p:ExportVariables>\n        <L7p:CommentAssertion>\n            <L7p:Comment stringValue=\"Step 4: if validation failed, return a 400 JSON error response and short-circuit the policy.\"/>\n        </L7p:CommentAssertion>\n        <wsp:OneOrMore wsp:Usage=\"Required\">\n            <L7p:ComparisonAssertion>\n                <L7p:CaseSensitive booleanValue=\"false\"/>\n                <L7p:Expression1 stringValue=\"${errorMsg}\"/>\n                <L7p:Operator operatorNull=\"null\"/>\n                <L7p:Predicates predicates=\"included\">\n                    <L7p:item dataType=\"included\">\n                        <L7p:Type variableDataType=\"string\"/>\n                    </L7p:item>\n                    <L7p:item binary=\"included\">\n                        <L7p:Operator operator=\"EMPTY\"/>\n                        <L7p:RightValue stringValue=\"\"/>\n                    </L7p:item>\n                </L7p:Predicates>\n            </L7p:ComparisonAssertion>\n            <wsp:All wsp:Usage=\"Required\">\n                <L7p:CustomizeErrorResponse>\n                    <L7p:Content stringValue=\"{&quot;error&quot;:{&quot;code&quot;:400,&quot;message&quot;:&quot;${errorMsg}&quot;}}\"/>\n                    <L7p:ContentType stringValue=\"application/json\"/>\n                    <L7p:ExtraHeaders nameValuePairArray=\"included\"/>\n                    <L7p:HttpStatus stringValue=\"400\"/>\n                </L7p:CustomizeErrorResponse>\n                <L7p:FalseAssertion/>\n            </wsp:All>\n        </wsp:OneOrMore>\n    </wsp:All>\n</wsp:Policy>\n"
      }
    }
  ],
  "properties": {
    "defaultAction": "NEW_OR_UPDATE",
    "meta": {
      "name": "ValidateXMLSchema-1.0 Bundle",
      "schema": "11.2.1"
    },
    "mappings": {}
  }
}