Enterprise Policies help organization admins enforce organization-wide security and management rules. Currently, Apidog supports the following enterprise policies:Enterprise Policies are only available for organizations with the Enterprise plan.
Open Enterprise Policies#
To configure Enterprise Policies:1.
Go to Organization Settings.
2.
Navigate to the Security section.
3.
Select Enterprise Policies.
Only organization admins or owners can configure Enterprise Policies.
Auth Credential Policy#
Auth Credential Policy helps prevent sensitive authentication credentials from being saved or displayed in insecure ways.The policy applies to supported authentication fields when users edit or save API authentication, folder authentication, request authentication, security schemes, API test cases, and test scenarios.Policy options#
| Policy | Modes | Description |
|---|
| Forbid raw values in Auth sensitive fields | Off, Warn, Block | Controls whether users can save plaintext sensitive values in supported authentication fields. |
| Allow only local variables or Vault Secret in Auth | Off, Warn, Block | Controls whether sensitive authentication fields must use local-only variables or Vault Secret references. |
| Vault Secret cannot be revealed in plaintext | On, Off | Prevents Vault Secret values from being revealed in plaintext in the UI. |
Policy modes#
| Mode | Behavior |
|---|
| Off | The policy is not enforced. |
| Warn | Users are warned when a value does not comply, but saving is still allowed. |
| Block | Users cannot save values that do not comply. |
Supported authentication types and sensitive fields#
| Authentication type | Sensitive fields |
|---|
| API Key | Value |
| Bearer [REDACTED] | Token |
| Basic Auth | Password |
| Digest Auth | Password |
| OAuth 1.0 | Consumer Secret, Token Secret, Private Key |
| OAuth 2.0 | Access Token, Client Secret, Password |
| Hawk | Auth Key |
| AWS | Secret Key, Session Token |
| NTLM | Password |
| Akamai EdgeGrid | Access Token, Client Token, Client Secret |
| JWT Bearer | Secret, Private Key |
Combination authentication is also checked recursively.Allowed credential references#
When Auth Credential Policy is enabled, Apidog treats the following as allowed references:variable references, such as {{variableName}};
Vault Secret references, such as {{vault:key}}.
Invitation Reward Policy#
Invitation Reward Policy controls whether users can earn invitation rewards from invitations associated with the organization.When invitation rewards are enabled, eligible invitations can generate Credits for the inviter after the invited user successfully registers.When invitation rewards are disabled, eligible organization-related invitations no longer generate invitation reward Credits.Disabling invitation rewards does not remove Credits that have already been earned.
1.
Open Organization Settings.
2.
Go to Security > Enterprise Policies.
3.
Find Invitation Reward Policy.
4.
Enable or disable invitation rewards for the organization.
