AI Azure Content Safety Configuration

Configuration

This plugin is compatible with DB-less mode.

Compatible protocols

The AI Azure Content Safety plugin is compatible with the following protocols:

grpc, grpcs, http, https

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

• name or plugin

  string required

  The name of the plugin, in this case ai-azure-content-safety.

  • If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is name.
  • If using the KongPlugin object in Kubernetes, the field is plugin.

• instance_name

  string

  An optional custom name to identify an instance of the plugin, for example ai-azure-content-safety_my-service.

  The instance name shows up in Kong Manager and in Konnect, so it's useful when running the same plugin in multiple contexts, for example, on multiple services. You can also use it to access a specific plugin instance via the Kong Admin API.

  An instance name must be unique within the following context:

  • Within a workspace for Kong Gateway Enterprise
  • Within a control plane or control plane group for Konnect
  • Globally for Kong Gateway (OSS)

• service.name or service.id

  string

  The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint. Not required if using /services/{serviceName|Id}/plugins.

• route.name or route.id

  string

  The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint. Not required if using /routes/{routeName|Id}/plugins.

• enabled

  boolean default: true

  Whether this plugin will be applied.

• config

  record required
  • content_safety_url

    string required referenceable

    Full URL, inc protocol, of the Azure Content Safety instance.

  • azure_api_version

    string required default: 2023-10-01 len_min: 1

    Sets the ?api-version URL parameter, used for defining the Azure Content Services interchange format.

  • azure_use_managed_identity

    boolean default: false

    If checked, uses (if set) azure_client_id, azure_client_secret, and/or azure_tenant_id for Azure authentication, via Managed or User-assigned identity

  • azure_client_id

    string

    If azure_use_managed_identity is true, set the client ID if required.

  • azure_client_secret

    string

    If azure_use_managed_identity is true, set the client secret if required.

  • azure_tenant_id

    string

    If azure_use_managed_identity is true, set the tenant ID if required.

  • content_safety_key

    string referenceable encrypted

    If azure_use_managed_identity is true, set the API key to call Content Safety.

  • text_source

    string default: concatenate_all_content Must be one of: concatenate_all_content, concatenate_user_content

    Select where to pick the ‘text’ for the Azure Content Services request.

  • categories

    array of type record

    Array of categories, and their thresholds, to measure on.

    • name

      string required

    • rejection_level

      integer required

  • reveal_failure_reason

    boolean default: true

    Set true to tell the caller why their request was rejected, if so.

  • output_type

    string default: FourSeverityLevels Must be one of: FourSeverityLevels, EightSeverityLevels

    See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/content-filter#content-filtering-categories

  • blocklist_names

    array of type string

    Use these configured blocklists (in Azure Content Services) when inspecting content.

  • halt_on_blocklist_hit

    boolean default: true

    Tells Azure to reject the request if any blocklist filter is hit.