human-readable description of what uses the API key to authenticate. optional, max 255 bytes.

arbitrary user-defined data of this API key. optional, max 4096 bytes

unique API key resource identifier

URI to the API resource of this API key

human-readable description of what uses the API key to authenticate. optional, max 255 bytes.

arbitrary user-defined data of this API key. optional, max 4096 bytes

timestamp when the api key was created, RFC 3339 format

the bearer token that can be placed into the Authorization header to authenticate request to the ngrok API. This value is only available one time, on the API response from key creation. Otherwise it is null.

unique API key resource identifier

URI to the API resource of this API key

human-readable description of what uses the API key to authenticate. optional, max 255 bytes.

arbitrary user-defined data of this API key. optional, max 4096 bytes

timestamp when the api key was created, RFC 3339 format

the bearer token that can be placed into the Authorization header to authenticate request to the ngrok API. This value is only available one time, on the API response from key creation. Otherwise it is null.

the list of API keys for this account

URI of the API keys list API resource

URI of the next page, or null if there is no next page

unique API key resource identifier

URI to the API resource of this API key

human-readable description of what uses the API key to authenticate. optional, max 255 bytes.

arbitrary user-defined data of this API key. optional, max 4096 bytes

timestamp when the api key was created, RFC 3339 format

the bearer token that can be placed into the Authorization header to authenticate request to the ngrok API. This value is only available one time, on the API response from key creation. Otherwise it is null.

human-readable description of what uses the API key to authenticate. optional, max 255 bytes.

arbitrary user-defined data of this API key. optional, max 4096 bytes

unique API key resource identifier

URI to the API resource of this API key

human-readable description of what uses the API key to authenticate. optional, max 255 bytes.

arbitrary user-defined data of this API key. optional, max 4096 bytes

timestamp when the api key was created, RFC 3339 format

the bearer token that can be placed into the Authorization header to authenticate request to the ngrok API. This value is only available one time, on the API response from key creation. Otherwise it is null.

a list of URLs containing suspected abusive content

arbitrary user-defined data about this abuse report. Optional, max 4096 bytes.

ID of the abuse report

URI of the abuse report API resource

timestamp that the abuse report record was created in RFC 3339 format

a list of URLs containing suspected abusive content

arbitrary user-defined data about this abuse report. Optional, max 4096 bytes.

Indicates whether ngrok has processed the abuse report. one of PENDING, PROCESSED, or PARTIALLY_PROCESSED

an array of hostname statuses related to the report

the hostname ngrok has parsed out of one of the reported URLs in this abuse report

indicates what action ngrok has taken against the hostname. one of PENDING, BANNED, UNBANNED, or IGNORE

ID of the abuse report

URI of the abuse report API resource

timestamp that the abuse report record was created in RFC 3339 format

a list of URLs containing suspected abusive content

arbitrary user-defined data about this abuse report. Optional, max 4096 bytes.

Indicates whether ngrok has processed the abuse report. one of PENDING, PROCESSED, or PARTIALLY_PROCESSED

an array of hostname statuses related to the report

the hostname ngrok has parsed out of one of the reported URLs in this abuse report

indicates what action ngrok has taken against the hostname. one of PENDING, BANNED, UNBANNED, or IGNORE

human-readable description of the use of this Agent Ingress. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Agent Ingress. optional, max 4096 bytes

the domain that you own to be used as the base domain name to generate regional agent ingress domains.

unique Agent Ingress resource identifier

URI to the API resource of this Agent ingress

human-readable description of the use of this Agent Ingress. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Agent Ingress. optional, max 4096 bytes

the domain that you own to be used as the base domain name to generate regional agent ingress domains.

a list of target values to use as the values of NS records for the domain property these values will delegate control over the domain to ngrok

a list of regional agent ingress domains that are subdomains of the value of domain this value may increase over time as ngrok adds more regions

timestamp when the Agent Ingress was created, RFC 3339 format

unique Agent Ingress resource identifier

URI to the API resource of this Agent ingress

human-readable description of the use of this Agent Ingress. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Agent Ingress. optional, max 4096 bytes

the domain that you own to be used as the base domain name to generate regional agent ingress domains.

a list of target values to use as the values of NS records for the domain property these values will delegate control over the domain to ngrok

a list of regional agent ingress domains that are subdomains of the value of domain this value may increase over time as ngrok adds more regions

timestamp when the Agent Ingress was created, RFC 3339 format

the list of Agent Ingresses owned by this account

URI of the Agent Ingress list API resource

URI of the next page, or null if there is no next page

unique Agent Ingress resource identifier

URI to the API resource of this Agent ingress

human-readable description of the use of this Agent Ingress. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Agent Ingress. optional, max 4096 bytes

the domain that you own to be used as the base domain name to generate regional agent ingress domains.

a list of target values to use as the values of NS records for the domain property these values will delegate control over the domain to ngrok

a list of regional agent ingress domains that are subdomains of the value of domain this value may increase over time as ngrok adds more regions

timestamp when the Agent Ingress was created, RFC 3339 format

human-readable description of the use of this Agent Ingress. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Agent Ingress. optional, max 4096 bytes

unique Agent Ingress resource identifier

URI to the API resource of this Agent ingress

human-readable description of the use of this Agent Ingress. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Agent Ingress. optional, max 4096 bytes

the domain that you own to be used as the base domain name to generate regional agent ingress domains.

a list of target values to use as the values of NS records for the domain property these values will delegate control over the domain to ngrok

a list of regional agent ingress domains that are subdomains of the value of domain this value may increase over time as ngrok adds more regions

timestamp when the Agent Ingress was created, RFC 3339 format

human-readable description of this Certificate Authority. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Certificate Authority. optional, max 4096 bytes.

raw PEM of the Certificate Authority

unique identifier for this Certificate Authority

URI of the Certificate Authority API resource

timestamp when the Certificate Authority was created, RFC 3339 format

human-readable description of this Certificate Authority. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Certificate Authority. optional, max 4096 bytes.

raw PEM of the Certificate Authority

subject common name of the Certificate Authority

timestamp when this Certificate Authority becomes valid, RFC 3339 format

timestamp when this Certificate Authority becomes invalid, RFC 3339 format

set of actions the private key of this Certificate Authority can be used for

extended set of actions the private key of this Certificate Authority can be used for

unique identifier for this Certificate Authority

URI of the Certificate Authority API resource

timestamp when the Certificate Authority was created, RFC 3339 format

human-readable description of this Certificate Authority. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Certificate Authority. optional, max 4096 bytes.

raw PEM of the Certificate Authority

subject common name of the Certificate Authority

timestamp when this Certificate Authority becomes valid, RFC 3339 format

timestamp when this Certificate Authority becomes invalid, RFC 3339 format

set of actions the private key of this Certificate Authority can be used for

extended set of actions the private key of this Certificate Authority can be used for

the list of all certificate authorities on this account

URI of the certificates authorities list API resource

URI of the next page, or null if there is no next page

unique identifier for this Certificate Authority

URI of the Certificate Authority API resource

timestamp when the Certificate Authority was created, RFC 3339 format

human-readable description of this Certificate Authority. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Certificate Authority. optional, max 4096 bytes.

raw PEM of the Certificate Authority

subject common name of the Certificate Authority

timestamp when this Certificate Authority becomes valid, RFC 3339 format

timestamp when this Certificate Authority becomes invalid, RFC 3339 format

set of actions the private key of this Certificate Authority can be used for

extended set of actions the private key of this Certificate Authority can be used for

human-readable description of this Certificate Authority. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Certificate Authority. optional, max 4096 bytes.

unique identifier for this Certificate Authority

URI of the Certificate Authority API resource

timestamp when the Certificate Authority was created, RFC 3339 format

human-readable description of this Certificate Authority. optional, max 255 bytes.

arbitrary user-defined machine-readable data of this Certificate Authority. optional, max 4096 bytes.

raw PEM of the Certificate Authority

subject common name of the Certificate Authority

timestamp when this Certificate Authority becomes valid, RFC 3339 format

timestamp when this Certificate Authority becomes invalid, RFC 3339 format

set of actions the private key of this Certificate Authority can be used for

extended set of actions the private key of this Certificate Authority can be used for

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

they type of traffic this endpoint configuration can be applied to. one of: http, https, tcp

human-readable description of what this endpoint configuration will be do when applied or what traffic it will be applied to. Optional, max 255 bytes

arbitrary user-defined machine-readable data of this endpoint configuration. Optional, max 4096 bytes.

circuit breaker module configuration or null

compression module configuration or null

request headers module configuration or null

response headers module configuration or null

ip policy module configuration or null

mutual TLS module configuration or null

TLS termination module configuration or null

webhook validation module configuration or null

oauth module configuration or null

logging module configuration or null

saml module configuration or null

oidc module configuration or null

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Request before being sent to the upstream application server

a list of header names that will be removed from the HTTP Request before being sent to the upstream application server

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Response returned to the HTTP client

a list of header names that will be removed from the HTTP Response returned to the HTTP client

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all IP policies that will be used to check if a source IP is allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of certificate authorities that will be used to validate the TLS client certificate presnted by the initiatiator of the TLS connection

true if the module will be applied to traffic, false to disable. default true if unspecified

edge if the ngrok edge should terminate TLS traffic, upstream if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if upstream is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.

The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if terminate_at is set to upstream.

true if the module will be applied to traffic, false to disable. default true if unspecified

a string indicating which webhook provider will be sending webhooks to this endpoint. Value must be one of the supported providers: SLACK, SNS, STRIPE, GITHUB, TWILIO, SHOPIFY, GITLAB, INTERCOM, SENDGRID, XERO.

a string secret used to validate requests from the given provider. All providers except AWS SNS require a secret

true if the module will be applied to traffic, false to disable. default true if unspecified

an object which defines the identity provider to use for authentication and configuration for who may access the endpoint

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

Integer number of seconds after which ngrok guarantees it will refresh user state from the identity provider and recheck whether the user is still authorized to access the endpoint. This is the preferred tunable to use to enforce a minimum amount of time after which a revoked user will no longer be able to access the resource.

configuration for using github as the identity provider

configuration for using facebook as the identity provider

configuration for using microsoft as the identity provider

configuration for using google as the identity provider

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

a list of github teams identifiers. users will be allowed access to the endpoint if they are a member of any of these teams. identifiers should be in the ‘slug’ format qualified with the org name, e.g. org-name/team-name

a list of github org identifiers. users who are members of any of the listed organizations will be allowed access. identifiers should be the organization’s ‘slug’

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all EventStreams that will be used to configure and export this endpoint’s logs

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.

If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.

If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.

If present, only users who are a member of one of the listed groups may access the target endpoint.

Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

URL of the OIDC “OpenID provider”. This is the base URL used for discovery.

The OIDC app’s client ID and OIDC audience.

The OIDC app’s client secret.

The set of scopes to request from the OIDC identity provider.

unique identifier of this endpoint configuration

they type of traffic this endpoint configuration can be applied to. one of: http, https, tcp

human-readable description of what this endpoint configuration will be do when applied or what traffic it will be applied to. Optional, max 255 bytes

arbitrary user-defined machine-readable data of this endpoint configuration. Optional, max 4096 bytes.

timestamp when the endpoint configuration was created, RFC 3339 format

URI of the endpoint configuration API resource

circuit breaker module configuration or null

compression module configuration or null

request headers module configuration or null

response headers module configuration or null

ip policy module configuration or null

mutual TLS module configuration or null

TLS termination module configuration or null

webhook validation module configuration or null

oauth module configuration or null

logging module configuration or null

saml module configuration or null

oidc module configuration or null

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Request before being sent to the upstream application server

a list of header names that will be removed from the HTTP Request before being sent to the upstream application server

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Response returned to the HTTP client

a list of header names that will be removed from the HTTP Response returned to the HTTP client

true if the module will be applied to traffic, false to disable. default true if unspecified

a resource identifier

a uri for locating a resource

true if the module will be applied to traffic, false to disable. default true if unspecified

PEM-encoded CA certificates that will be used to validate. Multiple CAs may be provided by concatenating them together.

true if the module will be applied to traffic, false to disable. default true if unspecified

edge if the ngrok edge should terminate TLS traffic, upstream if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if upstream is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.

The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if terminate_at is set to upstream.

true if the module will be applied to traffic, false to disable. default true if unspecified

a string indicating which webhook provider will be sending webhooks to this endpoint. Value must be one of the supported providers: SLACK, SNS, STRIPE, GITHUB, TWILIO, SHOPIFY, GITLAB, INTERCOM, SENDGRID, XERO.

a string secret used to validate requests from the given provider. All providers except AWS SNS require a secret

true if the module will be applied to traffic, false to disable. default true if unspecified

an object which defines the identity provider to use for authentication and configuration for who may access the endpoint

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

Integer number of seconds after which ngrok guarantees it will refresh user state from the identity provider and recheck whether the user is still authorized to access the endpoint. This is the preferred tunable to use to enforce a minimum amount of time after which a revoked user will no longer be able to access the resource.

configuration for using github as the identity provider

configuration for using facebook as the identity provider

configuration for using microsoft as the identity provider

configuration for using google as the identity provider

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

a list of github teams identifiers. users will be allowed access to the endpoint if they are a member of any of these teams. identifiers should be in the ‘slug’ format qualified with the org name, e.g. org-name/team-name

a list of github org identifiers. users who are members of any of the listed organizations will be allowed access. identifiers should be the organization’s ‘slug’

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all EventStreams that will be used to configure and export this endpoint’s logs

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.

If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.

If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.

If present, only users who are a member of one of the listed groups may access the target endpoint.

The SP Entity’s unique ID. This always takes the form of a URL. In ngrok’s implementation, this URL is the same as the metadata URL. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Assertion Consumer Service. This is where the IdP will redirect to during an authentication flow. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Single Logout Service. This is where the IdP will redirect to during a single logout flow. This will optionally need to be specified to the IdP as configuration.

PEM-encoded x.509 certificate of the key pair that is used to sign all SAML requests that the ngrok SP makes to the IdP. Many IdPs do not support request signing verification, but we highly recommend specifying this in the IdP’s configuration if it is supported.

A public URL where the SP’s metadata is hosted. If an IdP supports dynamic configuration, this is the URL it can use to retrieve the SP metadata.

Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

URL of the OIDC “OpenID provider”. This is the base URL used for discovery.

The OIDC app’s client ID and OIDC audience.

The OIDC app’s client secret.

The set of scopes to request from the OIDC identity provider.

unique identifier of this endpoint configuration

they type of traffic this endpoint configuration can be applied to. one of: http, https, tcp

human-readable description of what this endpoint configuration will be do when applied or what traffic it will be applied to. Optional, max 255 bytes

arbitrary user-defined machine-readable data of this endpoint configuration. Optional, max 4096 bytes.

timestamp when the endpoint configuration was created, RFC 3339 format

URI of the endpoint configuration API resource

circuit breaker module configuration or null

compression module configuration or null

request headers module configuration or null

response headers module configuration or null

ip policy module configuration or null

mutual TLS module configuration or null

TLS termination module configuration or null

webhook validation module configuration or null

oauth module configuration or null

logging module configuration or null

saml module configuration or null

oidc module configuration or null

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Request before being sent to the upstream application server

a list of header names that will be removed from the HTTP Request before being sent to the upstream application server

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Response returned to the HTTP client

a list of header names that will be removed from the HTTP Response returned to the HTTP client

true if the module will be applied to traffic, false to disable. default true if unspecified

a resource identifier

a uri for locating a resource

true if the module will be applied to traffic, false to disable. default true if unspecified

PEM-encoded CA certificates that will be used to validate. Multiple CAs may be provided by concatenating them together.

true if the module will be applied to traffic, false to disable. default true if unspecified

edge if the ngrok edge should terminate TLS traffic, upstream if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if upstream is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.

The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if terminate_at is set to upstream.

true if the module will be applied to traffic, false to disable. default true if unspecified

a string indicating which webhook provider will be sending webhooks to this endpoint. Value must be one of the supported providers: SLACK, SNS, STRIPE, GITHUB, TWILIO, SHOPIFY, GITLAB, INTERCOM, SENDGRID, XERO.

a string secret used to validate requests from the given provider. All providers except AWS SNS require a secret

true if the module will be applied to traffic, false to disable. default true if unspecified

an object which defines the identity provider to use for authentication and configuration for who may access the endpoint

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

Integer number of seconds after which ngrok guarantees it will refresh user state from the identity provider and recheck whether the user is still authorized to access the endpoint. This is the preferred tunable to use to enforce a minimum amount of time after which a revoked user will no longer be able to access the resource.

configuration for using github as the identity provider

configuration for using facebook as the identity provider

configuration for using microsoft as the identity provider

configuration for using google as the identity provider

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

a list of github teams identifiers. users will be allowed access to the endpoint if they are a member of any of these teams. identifiers should be in the ‘slug’ format qualified with the org name, e.g. org-name/team-name

a list of github org identifiers. users who are members of any of the listed organizations will be allowed access. identifiers should be the organization’s ‘slug’

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all EventStreams that will be used to configure and export this endpoint’s logs

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.

If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.

If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.

If present, only users who are a member of one of the listed groups may access the target endpoint.

The SP Entity’s unique ID. This always takes the form of a URL. In ngrok’s implementation, this URL is the same as the metadata URL. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Assertion Consumer Service. This is where the IdP will redirect to during an authentication flow. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Single Logout Service. This is where the IdP will redirect to during a single logout flow. This will optionally need to be specified to the IdP as configuration.

PEM-encoded x.509 certificate of the key pair that is used to sign all SAML requests that the ngrok SP makes to the IdP. Many IdPs do not support request signing verification, but we highly recommend specifying this in the IdP’s configuration if it is supported.

A public URL where the SP’s metadata is hosted. If an IdP supports dynamic configuration, this is the URL it can use to retrieve the SP metadata.

Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

URL of the OIDC “OpenID provider”. This is the base URL used for discovery.

The OIDC app’s client ID and OIDC audience.

The OIDC app’s client secret.

The set of scopes to request from the OIDC identity provider.

the list of all endpoint configurations on this account

URI of the endpoint configurations list API resource

URI of the next page, or null if there is no next page

unique identifier of this endpoint configuration

they type of traffic this endpoint configuration can be applied to. one of: http, https, tcp

human-readable description of what this endpoint configuration will be do when applied or what traffic it will be applied to. Optional, max 255 bytes

arbitrary user-defined machine-readable data of this endpoint configuration. Optional, max 4096 bytes.

timestamp when the endpoint configuration was created, RFC 3339 format

URI of the endpoint configuration API resource

circuit breaker module configuration or null

compression module configuration or null

request headers module configuration or null

response headers module configuration or null

ip policy module configuration or null

mutual TLS module configuration or null

TLS termination module configuration or null

webhook validation module configuration or null

oauth module configuration or null

logging module configuration or null

saml module configuration or null

oidc module configuration or null

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Request before being sent to the upstream application server

a list of header names that will be removed from the HTTP Request before being sent to the upstream application server

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Response returned to the HTTP client

a list of header names that will be removed from the HTTP Response returned to the HTTP client

true if the module will be applied to traffic, false to disable. default true if unspecified

a resource identifier

a uri for locating a resource

true if the module will be applied to traffic, false to disable. default true if unspecified

PEM-encoded CA certificates that will be used to validate. Multiple CAs may be provided by concatenating them together.

true if the module will be applied to traffic, false to disable. default true if unspecified

edge if the ngrok edge should terminate TLS traffic, upstream if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if upstream is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.

The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if terminate_at is set to upstream.

true if the module will be applied to traffic, false to disable. default true if unspecified

a string indicating which webhook provider will be sending webhooks to this endpoint. Value must be one of the supported providers: SLACK, SNS, STRIPE, GITHUB, TWILIO, SHOPIFY, GITLAB, INTERCOM, SENDGRID, XERO.

a string secret used to validate requests from the given provider. All providers except AWS SNS require a secret

true if the module will be applied to traffic, false to disable. default true if unspecified

an object which defines the identity provider to use for authentication and configuration for who may access the endpoint

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

Integer number of seconds after which ngrok guarantees it will refresh user state from the identity provider and recheck whether the user is still authorized to access the endpoint. This is the preferred tunable to use to enforce a minimum amount of time after which a revoked user will no longer be able to access the resource.

configuration for using github as the identity provider

configuration for using facebook as the identity provider

configuration for using microsoft as the identity provider

configuration for using google as the identity provider

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

a list of github teams identifiers. users will be allowed access to the endpoint if they are a member of any of these teams. identifiers should be in the ‘slug’ format qualified with the org name, e.g. org-name/team-name

a list of github org identifiers. users who are members of any of the listed organizations will be allowed access. identifiers should be the organization’s ‘slug’

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all EventStreams that will be used to configure and export this endpoint’s logs

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.

If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.

If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.

If present, only users who are a member of one of the listed groups may access the target endpoint.

The SP Entity’s unique ID. This always takes the form of a URL. In ngrok’s implementation, this URL is the same as the metadata URL. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Assertion Consumer Service. This is where the IdP will redirect to during an authentication flow. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Single Logout Service. This is where the IdP will redirect to during a single logout flow. This will optionally need to be specified to the IdP as configuration.

PEM-encoded x.509 certificate of the key pair that is used to sign all SAML requests that the ngrok SP makes to the IdP. Many IdPs do not support request signing verification, but we highly recommend specifying this in the IdP’s configuration if it is supported.

A public URL where the SP’s metadata is hosted. If an IdP supports dynamic configuration, this is the URL it can use to retrieve the SP metadata.

Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

URL of the OIDC “OpenID provider”. This is the base URL used for discovery.

The OIDC app’s client ID and OIDC audience.

The OIDC app’s client secret.

The set of scopes to request from the OIDC identity provider.

unique identifier of this endpoint configuration

human-readable description of what this endpoint configuration will be do when applied or what traffic it will be applied to. Optional, max 255 bytes

arbitrary user-defined machine-readable data of this endpoint configuration. Optional, max 4096 bytes.

circuit breaker module configuration or null

compression module configuration or null

request headers module configuration or null

response headers module configuration or null

ip policy module configuration or null

mutual TLS module configuration or null

TLS termination module configuration or null

webhook validation module configuration or null

oauth module configuration or null

logging module configuration or null

saml module configuration or null

oidc module configuration or null

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Request before being sent to the upstream application server

a list of header names that will be removed from the HTTP Request before being sent to the upstream application server

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Response returned to the HTTP client

a list of header names that will be removed from the HTTP Response returned to the HTTP client

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all IP policies that will be used to check if a source IP is allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of certificate authorities that will be used to validate the TLS client certificate presnted by the initiatiator of the TLS connection

true if the module will be applied to traffic, false to disable. default true if unspecified

edge if the ngrok edge should terminate TLS traffic, upstream if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if upstream is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.

The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if terminate_at is set to upstream.

true if the module will be applied to traffic, false to disable. default true if unspecified

a string indicating which webhook provider will be sending webhooks to this endpoint. Value must be one of the supported providers: SLACK, SNS, STRIPE, GITHUB, TWILIO, SHOPIFY, GITLAB, INTERCOM, SENDGRID, XERO.

a string secret used to validate requests from the given provider. All providers except AWS SNS require a secret

true if the module will be applied to traffic, false to disable. default true if unspecified

an object which defines the identity provider to use for authentication and configuration for who may access the endpoint

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

Integer number of seconds after which ngrok guarantees it will refresh user state from the identity provider and recheck whether the user is still authorized to access the endpoint. This is the preferred tunable to use to enforce a minimum amount of time after which a revoked user will no longer be able to access the resource.

configuration for using github as the identity provider

configuration for using facebook as the identity provider

configuration for using microsoft as the identity provider

configuration for using google as the identity provider

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

a list of github teams identifiers. users will be allowed access to the endpoint if they are a member of any of these teams. identifiers should be in the ‘slug’ format qualified with the org name, e.g. org-name/team-name

a list of github org identifiers. users who are members of any of the listed organizations will be allowed access. identifiers should be the organization’s ‘slug’

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all EventStreams that will be used to configure and export this endpoint’s logs

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.

If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.

If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.

If present, only users who are a member of one of the listed groups may access the target endpoint.

Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

URL of the OIDC “OpenID provider”. This is the base URL used for discovery.

The OIDC app’s client ID and OIDC audience.

The OIDC app’s client secret.

The set of scopes to request from the OIDC identity provider.

unique identifier of this endpoint configuration

they type of traffic this endpoint configuration can be applied to. one of: http, https, tcp

human-readable description of what this endpoint configuration will be do when applied or what traffic it will be applied to. Optional, max 255 bytes

arbitrary user-defined machine-readable data of this endpoint configuration. Optional, max 4096 bytes.

timestamp when the endpoint configuration was created, RFC 3339 format

URI of the endpoint configuration API resource

circuit breaker module configuration or null

compression module configuration or null

request headers module configuration or null

response headers module configuration or null

ip policy module configuration or null

mutual TLS module configuration or null

TLS termination module configuration or null

webhook validation module configuration or null

oauth module configuration or null

logging module configuration or null

saml module configuration or null

oidc module configuration or null

true if the module will be applied to traffic, false to disable. default true if unspecified

Integer number of seconds after which the circuit is tripped to wait before re-evaluating upstream health

Integer number of seconds in the statistical rolling window that metrics are retained for.

Integer number of buckets into which metrics are retained. Max 128.

Integer number of requests in a rolling window that will trip the circuit. Helpful if traffic volume is low.

Error threshold percentage should be between 0 - 1.0, not 0-100.0

true if the module will be applied to traffic, false to disable. default true if unspecified

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Request before being sent to the upstream application server

a list of header names that will be removed from the HTTP Request before being sent to the upstream application server

true if the module will be applied to traffic, false to disable. default true if unspecified

a map of header key to header value that will be injected into the HTTP Response returned to the HTTP client

a list of header names that will be removed from the HTTP Response returned to the HTTP client

true if the module will be applied to traffic, false to disable. default true if unspecified

a resource identifier

a uri for locating a resource

true if the module will be applied to traffic, false to disable. default true if unspecified

PEM-encoded CA certificates that will be used to validate. Multiple CAs may be provided by concatenating them together.

true if the module will be applied to traffic, false to disable. default true if unspecified

edge if the ngrok edge should terminate TLS traffic, upstream if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if upstream is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.

The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if terminate_at is set to upstream.

true if the module will be applied to traffic, false to disable. default true if unspecified

a string indicating which webhook provider will be sending webhooks to this endpoint. Value must be one of the supported providers: SLACK, SNS, STRIPE, GITHUB, TWILIO, SHOPIFY, GITLAB, INTERCOM, SENDGRID, XERO.

a string secret used to validate requests from the given provider. All providers except AWS SNS require a secret

true if the module will be applied to traffic, false to disable. default true if unspecified

an object which defines the identity provider to use for authentication and configuration for who may access the endpoint

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

Integer number of seconds after which ngrok guarantees it will refresh user state from the identity provider and recheck whether the user is still authorized to access the endpoint. This is the preferred tunable to use to enforce a minimum amount of time after which a revoked user will no longer be able to access the resource.

configuration for using github as the identity provider

configuration for using facebook as the identity provider

configuration for using microsoft as the identity provider

configuration for using google as the identity provider

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

a list of github teams identifiers. users will be allowed access to the endpoint if they are a member of any of these teams. identifiers should be in the ‘slug’ format qualified with the org name, e.g. org-name/team-name

a list of github org identifiers. users who are members of any of the listed organizations will be allowed access. identifiers should be the organization’s ‘slug’

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

the OAuth app client ID. retrieve it from the identity provider’s dashboard where you created your own OAuth app. optional. if unspecified, ngrok will use its own managed oauth application which has additional restrictions. see the OAuth module docs for more details. if present, client_secret must be present as well.

the OAuth app client secret. retrieve if from the identity provider’s dashboard where you created your own OAuth app. optional, see all of the caveats in the docs for client_id.

a list of provider-specific OAuth scopes with the permissions your OAuth app would like to ask for. these may not be set if you are using the ngrok-managed oauth app (i.e. you must pass both client_id and client_secret to set scopes)

a list of email addresses of users authenticated by identity provider who are allowed access to the endpoint

a list of email domains of users authenticated by identity provider who are allowed access to the endpoint

true if the module will be applied to traffic, false to disable. default true if unspecified

list of all EventStreams that will be used to configure and export this endpoint’s logs

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.

If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.

If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.

If present, only users who are a member of one of the listed groups may access the target endpoint.

The SP Entity’s unique ID. This always takes the form of a URL. In ngrok’s implementation, this URL is the same as the metadata URL. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Assertion Consumer Service. This is where the IdP will redirect to during an authentication flow. This will need to be specified to the IdP as configuration.

The public URL of the SP’s Single Logout Service. This is where the IdP will redirect to during a single logout flow. This will optionally need to be specified to the IdP as configuration.

PEM-encoded x.509 certificate of the key pair that is used to sign all SAML requests that the ngrok SP makes to the IdP. Many IdPs do not support request signing verification, but we highly recommend specifying this in the IdP’s configuration if it is supported.

A public URL where the SP’s metadata is hosted. If an IdP supports dynamic configuration, this is the URL it can use to retrieve the SP metadata.

Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

true if the module will be applied to traffic, false to disable. default true if unspecified

Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.

the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is ‘ngrok.’

Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.

Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.

URL of the OIDC “OpenID provider”. This is the base URL used for discovery.

The OIDC app’s client ID and OIDC audience.

The OIDC app’s client secret.

The set of scopes to request from the OIDC identity provider.

Arbitrary user-defined machine-readable data of this Event Destination. Optional, max 4096 bytes.

Human-readable description of the Event Destination. Optional, max 255 bytes.

The output format you would like to serialize events into when sending to their target. Currently the only accepted value is JSON.

An object that encapsulates where and how to send your events. An event destination must contain exactly one of the following objects, leaving the rest null: kinesis, firehose, cloudwatch_logs, or s3.

Configuration used to send events to Amazon Kinesis Data Firehose.

Configuration used to send events to Amazon Kinesis.

Configuration used to send events to Amazon CloudWatch Logs.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Firehose delivery stream to deposit events into.

A role for ngrok to assume on your behalf to deposit events into your AWS account.

Credentials to your AWS account if you prefer ngrok to sign in with long-term access keys.

An ARN that specifies the role that ngrok should use to deliver to the configured target.

The ID portion of an AWS access key.

The secret portion of an AWS access key.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Kinesis stream to deposit events into.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the CloudWatch Logs group to deposit events into.

Unique identifier for this Event Destination.

Arbitrary user-defined machine-readable data of this Event Destination. Optional, max 4096 bytes.

Timestamp when the Event Destination was created, RFC 3339 format.

Human-readable description of the Event Destination. Optional, max 255 bytes.

The output format you would like to serialize events into when sending to their target. Currently the only accepted value is JSON.

An object that encapsulates where and how to send your events. An event destination must contain exactly one of the following objects, leaving the rest null: kinesis, firehose, cloudwatch_logs, or s3.

URI of the Event Destination API resource.

Configuration used to send events to Amazon Kinesis Data Firehose.

Configuration used to send events to Amazon Kinesis.

Configuration used to send events to Amazon CloudWatch Logs.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Firehose delivery stream to deposit events into.

A role for ngrok to assume on your behalf to deposit events into your AWS account.

Credentials to your AWS account if you prefer ngrok to sign in with long-term access keys.

An ARN that specifies the role that ngrok should use to deliver to the configured target.

The ID portion of an AWS access key.

The secret portion of an AWS access key.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Kinesis stream to deposit events into.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the CloudWatch Logs group to deposit events into.

Unique identifier for this Event Destination.

Arbitrary user-defined machine-readable data of this Event Destination. Optional, max 4096 bytes.

Timestamp when the Event Destination was created, RFC 3339 format.

Human-readable description of the Event Destination. Optional, max 255 bytes.

The output format you would like to serialize events into when sending to their target. Currently the only accepted value is JSON.

An object that encapsulates where and how to send your events. An event destination must contain exactly one of the following objects, leaving the rest null: kinesis, firehose, cloudwatch_logs, or s3.

URI of the Event Destination API resource.

Configuration used to send events to Amazon Kinesis Data Firehose.

Configuration used to send events to Amazon Kinesis.

Configuration used to send events to Amazon CloudWatch Logs.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Firehose delivery stream to deposit events into.

A role for ngrok to assume on your behalf to deposit events into your AWS account.

Credentials to your AWS account if you prefer ngrok to sign in with long-term access keys.

An ARN that specifies the role that ngrok should use to deliver to the configured target.

The ID portion of an AWS access key.

The secret portion of an AWS access key.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Kinesis stream to deposit events into.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the CloudWatch Logs group to deposit events into.

The list of all Event Destinations on this account.

URI of the Event Destinations list API resource.

URI of the next page, or null if there is no next page.

Unique identifier for this Event Destination.

Arbitrary user-defined machine-readable data of this Event Destination. Optional, max 4096 bytes.

Timestamp when the Event Destination was created, RFC 3339 format.

Human-readable description of the Event Destination. Optional, max 255 bytes.

The output format you would like to serialize events into when sending to their target. Currently the only accepted value is JSON.

An object that encapsulates where and how to send your events. An event destination must contain exactly one of the following objects, leaving the rest null: kinesis, firehose, cloudwatch_logs, or s3.

URI of the Event Destination API resource.

Configuration used to send events to Amazon Kinesis Data Firehose.

Configuration used to send events to Amazon Kinesis.

Configuration used to send events to Amazon CloudWatch Logs.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Firehose delivery stream to deposit events into.

A role for ngrok to assume on your behalf to deposit events into your AWS account.

Credentials to your AWS account if you prefer ngrok to sign in with long-term access keys.

An ARN that specifies the role that ngrok should use to deliver to the configured target.

The ID portion of an AWS access key.

The secret portion of an AWS access key.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Kinesis stream to deposit events into.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the CloudWatch Logs group to deposit events into.

Unique identifier for this Event Destination.

Arbitrary user-defined machine-readable data of this Event Destination. Optional, max 4096 bytes.

Human-readable description of the Event Destination. Optional, max 255 bytes.

The output format you would like to serialize events into when sending to their target. Currently the only accepted value is JSON.

An object that encapsulates where and how to send your events. An event destination must contain exactly one of the following objects, leaving the rest null: kinesis, firehose, cloudwatch_logs, or s3.

Configuration used to send events to Amazon Kinesis Data Firehose.

Configuration used to send events to Amazon Kinesis.

Configuration used to send events to Amazon CloudWatch Logs.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Firehose delivery stream to deposit events into.

A role for ngrok to assume on your behalf to deposit events into your AWS account.

Credentials to your AWS account if you prefer ngrok to sign in with long-term access keys.

An ARN that specifies the role that ngrok should use to deliver to the configured target.

The ID portion of an AWS access key.

The secret portion of an AWS access key.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Kinesis stream to deposit events into.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the CloudWatch Logs group to deposit events into.

Unique identifier for this Event Destination.

Arbitrary user-defined machine-readable data of this Event Destination. Optional, max 4096 bytes.

Timestamp when the Event Destination was created, RFC 3339 format.

Human-readable description of the Event Destination. Optional, max 255 bytes.

The output format you would like to serialize events into when sending to their target. Currently the only accepted value is JSON.

An object that encapsulates where and how to send your events. An event destination must contain exactly one of the following objects, leaving the rest null: kinesis, firehose, cloudwatch_logs, or s3.

URI of the Event Destination API resource.

Configuration used to send events to Amazon Kinesis Data Firehose.

Configuration used to send events to Amazon Kinesis.

Configuration used to send events to Amazon CloudWatch Logs.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Firehose delivery stream to deposit events into.

A role for ngrok to assume on your behalf to deposit events into your AWS account.

Credentials to your AWS account if you prefer ngrok to sign in with long-term access keys.

An ARN that specifies the role that ngrok should use to deliver to the configured target.

The ID portion of an AWS access key.

The secret portion of an AWS access key.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the Kinesis stream to deposit events into.

Configuration for how to authenticate into your AWS account. Exactly one of role or creds should be configured.

An Amazon Resource Name specifying the CloudWatch Logs group to deposit events into.

The unique identifier for the Event Subscription that this Event Source is attached to.

Type of event for which an event subscription will trigger

Type of event for which an event subscription will trigger

URI of the Event Source API resource.

Type of event for which an event subscription will trigger

URI of the Event Source API resource.

The list of all Event Sources for an Event Subscription

URI of the next page, or null if there is no next page.

Type of event for which an event subscription will trigger

URI of the Event Source API resource.

The unique identifier for the Event Subscription that this Event Source is attached to.

Type of event for which an event subscription will trigger

Type of event for which an event subscription will trigger

URI of the Event Source API resource.

Arbitrary user-defined machine-readable data of this Event Stream. Optional, max 4096 bytes.

Human-readable description of the Event Stream. Optional, max 255 bytes.

A list of protocol-specific fields you want to collect on each event.

The protocol that determines which events will be collected. Supported values are tcp_connection_closed and http_request_complete.

A list of Event Destination IDs which should be used for this Event Stream. Event Streams are required to have at least one Event Destination.

The percentage of all events you would like to capture. Valid values range from 0.01, representing 1% of all events to 1.00, representing 100% of all events.

Unique identifier for this Event Stream.

URI of the Event Stream API resource.

Timestamp when the Event Stream was created, RFC 3339 format.

Arbitrary user-defined machine-readable data of this Event Stream. Optional, max 4096 bytes.

Human-readable description of the Event Stream. Optional, max 255 bytes.

A list of protocol-specific fields you want to collect on each event.

The protocol that determines which events will be collected. Supported values are tcp_connection_closed and http_request_complete.

A list of Event Destination IDs which should be used for this Event Stream. Event Streams are required to have at least one Event Destination.

The percentage of all events you would like to capture. Valid values range from 0.01, representing 1% of all events to 1.00, representing 100% of all events.