Imperva API Security Configuration

Configuration

Compatible protocols

The Imperva API Security plugin is compatible with the following protocols:

http, https

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

• name or plugin

  string required

  The name of the plugin, in this case imp-appsec-connector.

  • If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is name.
  • If using the KongPlugin object in Kubernetes, the field is plugin.

• instance_name

  string

  An optional custom name to identify an instance of the plugin, for example imp-appsec-connector_my-service.

  The instance name shows up in Kong Manager and in Konnect, so it's useful when running the same plugin in multiple contexts, for example, on multiple services. You can also use it to access a specific plugin instance via the Kong Admin API.

  An instance name must be unique within the following context:

  • Within a workspace for Kong Gateway Enterprise
  • Within a control plane or control plane group for Konnect
  • Globally for Kong Gateway (OSS)

• service.name or service.id

  string

  The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint. Not required if using /services/{serviceName|Id}/plugins.

• route.name or route.id

  string

  The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint. Not required if using /routes/{routeName|Id}/plugins.

• enabled

  boolean default: true

  Whether this plugin will be applied.

• config

  record required
  • destination_addr

    string required encrypted

    Destination address of the API security receiver. This can be an IP address or domain name, for example logconsumer.myapisec.mydomain.

  • destination_port

    number default: 8080 Must be one of: 8080, 80, 8443, 443

    Destination port of the API security receiver.

  • connection_type

    string default: tcp Must be one of: tcp, http

    The connection protocol to use.

  • method

    string default: POST Must be one of: POST, PUT, PATCH

    The request method to use.

  • max_body_size

    number default: 1048576

    Maximum payload body size to capture, in bytes.

  • ssl

    boolean default: false

    Whether or not to use an TLS/SSL tunnel to send API traffic capture to the destination.

  • request_body_flag

    boolean default: true

    Determines whether to send the request body payload to the destination.

    Set to false to disable. Use only for debugging purposes. API security will not fully function without inspection of the request body payload.

  • response_body_flag

    boolean default: true

    Determines whether to send the response body payload to the destination.

    Set to false to disable. Use only for debugging purposes. API security will not fully function without inspection of the response body payload.

  • retry_count

    number default: 0

    Number of retries if sending the API call capture fails. No retry by default.

  • queue_size

    number default: 1

    Number of API logs to keep in the queue for retries. Default is 1, meaning no retries. Set to a number larger than 1 to enable retries.

  • flush_timeout

    number default: 2

    Number of seconds to wait before flushing the queue.

  • timeout

    number default: 6000000

    Number of milliseconds to keep a single connection open to the destination.