CredentialInjectionPolicy

API Group: clrk.apoxy.dev/v1alpha1

Operations

List CredentialInjectionPolicy

GET/apis/clrk.apoxy.dev/v1alpha1/credentialinjectionpolicies

List CredentialInjectionPolicy

Response

200: OK

List CredentialInjectionPolicy

GET/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/credentialinjectionpolicies

List CredentialInjectionPolicy

Response

200: OK

Create CredentialInjectionPolicy

POST/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/credentialinjectionpolicies

Create a CredentialInjectionPolicy

Request Body

Spec fields (CredentialInjectionSpec):

Field	Type	Description
`headerName`	string	HeaderName — required when target=Header.
`parentRefs`	ParentReference[]	ParentRefs attaches this policy to AIProviderRoute, MCPRoute, or EgressGateway listeners. The proxy applies the credential to traffic matching the referenced parent. Match semantics by parent kind: - AIProviderRoute: applies when the request matches that APR's rules (provider + endpoint + model gates). - MCPRoute: applies when the request matches that route (no-op until MCPRoute consumption ships). - EgressGateway: catch-all for any traffic on the gateway that no narrower policy claimed. (required)
`providerAuth`	ProviderAuthConfig	ProviderAuth — required when target=ProviderAuth.
`queryParamName`	string	QueryParamName — required when target=QueryParam.
`secretKey`	string	SecretKey selects a key within the Secret. Defaults to "token".
`secretRef`	SecretObjectReference	SecretRef points at a K8s Secret containing the credential. The `namespace` field is ignored: the Secret must live in the same namespace as the CredentialInjectionPolicy. Cross-namespace refs will gate on ReferenceGrant post-MVP. (required)
`target`	string	Target defines where to inject the credential. (required)

Response

200: OK
201: Created
202: Accepted

Delete All CredentialInjectionPolicy

DELETE/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/credentialinjectionpolicies

Delete collection of CredentialInjectionPolicy

Response

200: OK

Get CredentialInjectionPolicy

GET/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/credentialinjectionpolicies/{name}

Get the specified CredentialInjectionPolicy

Response

200: OK

Replace CredentialInjectionPolicy

PUT/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/credentialinjectionpolicies/{name}

Replace the specified CredentialInjectionPolicy

Request Body

Spec fields (CredentialInjectionSpec):

Field	Type	Description
`headerName`	string	HeaderName — required when target=Header.
`parentRefs`	ParentReference[]	ParentRefs attaches this policy to AIProviderRoute, MCPRoute, or EgressGateway listeners. The proxy applies the credential to traffic matching the referenced parent. Match semantics by parent kind: - AIProviderRoute: applies when the request matches that APR's rules (provider + endpoint + model gates). - MCPRoute: applies when the request matches that route (no-op until MCPRoute consumption ships). - EgressGateway: catch-all for any traffic on the gateway that no narrower policy claimed. (required)
`providerAuth`	ProviderAuthConfig	ProviderAuth — required when target=ProviderAuth.
`queryParamName`	string	QueryParamName — required when target=QueryParam.
`secretKey`	string	SecretKey selects a key within the Secret. Defaults to "token".
`secretRef`	SecretObjectReference	SecretRef points at a K8s Secret containing the credential. The `namespace` field is ignored: the Secret must live in the same namespace as the CredentialInjectionPolicy. Cross-namespace refs will gate on ReferenceGrant post-MVP. (required)
`target`	string	Target defines where to inject the credential. (required)

Response

200: OK
201: Created

Update CredentialInjectionPolicy

PATCH/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/credentialinjectionpolicies/{name}

Partially update the specified CredentialInjectionPolicy

Response

200: OK
201: Created

Delete CredentialInjectionPolicy

DELETE/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/credentialinjectionpolicies/{name}

Delete a CredentialInjectionPolicy

Response

200: OK
202: Accepted

Schema Reference

ProviderAuthConfig

Field	Type	Description
`region`	string
`service`	string
`type`	string	(required)