Configuration

Configuration Reference

Policy File Format

ContractShield policies can be written in YAML or JSON.

policyVersion: "0.1"

defaults:
  mode: enforce              # enforce | monitor
  unmatchedRouteAction: allow  # allow | block | monitor
  response:
    blockStatusCode: 403
  limits:
    maxBodyBytes: 1048576    # 1MB
    maxJsonDepth: 10
    maxArrayLength: 1000
  vulnerabilityChecks:
    prototypePollution: true
    pathTraversal: true
    ssrfInternal:
      fields: []
    commandInjection:
      fields: []
    nosqlInjection: false

routes:
  - id: string               # Unique route identifier
    match:
      method: GET            # GET | POST | PUT | DELETE | PATCH | *
      path: /api/resource    # Supports {param} placeholders
    contract:
      requestSchema: {}      # Inline JSON Schema
      requestSchemaRef: ""   # Path to external schema
      rejectUnknownFields: false
    webhook:
      provider: stripe       # stripe | github | slack | twilio | custom
      secretRef: ""          # Used by getSecret()
      timestampTolerance: 300
      replayProtection: false
      allowedEventTypes: []
    vulnerabilityChecks: {}  # Override defaults
    rules: []                # CEL rules

Environment Variables

Variable	Description
CONTRACTSHIELD_LICENSE	Pro license key
CONTRACTSHIELD_POLICY	Policy file path
CONTRACTSHIELD_LOG_LEVEL	Log level (debug, info, warn, error)