{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/cloudflare/main/json-schema/cloudflare-load-balancing-session-affinity-attributes-schema.json",
  "title": "load-balancing_session_affinity_attributes",
  "description": "Configures attributes for session affinity.",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudflare-zones-api-openapi.yml#/components/schemas/load-balancing_session_affinity_attributes",
  "type": "object",
  "properties": {
    "drain_duration": {
      "type": "number",
      "description": "Configures the drain duration in seconds. This field is only used when session affinity is enabled on the load balancer."
    },
    "headers": {
      "type": "array",
      "description": "Configures the names of HTTP headers to base session affinity on when header `session_affinity` is enabled. At least one HTTP header name must be provided. To specify the exact cookies to be used, include an item in the following format: `\"cookie:<cookie-name-1>,<cookie-name-2>\"` (example) where everything after the colon is a comma-separated list of cookie names. Providing only `\"cookie\"` will result in all cookies being used. The default max number of HTTP header names that can be provided depends on your plan: 5 for Enterprise, 1 for all other plans.",
      "default": "none",
      "uniqueItems": true,
      "items": {
        "type": "string",
        "description": "An HTTP header name.",
        "minLength": 1,
        "maxLength": 100,
        "pattern": "^[a-zA-Z0-9_-]+$"
      }
    },
    "require_all_headers": {
      "type": "boolean",
      "description": "When header `session_affinity` is enabled, this option can be used to specify how HTTP headers on load balancing requests will be used. The supported values are:\n- `\"true\"`: Load balancing requests must contain *all* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created.\n- `\"false\"`: Load balancing requests must contain *at least one* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created.",
      "default": false
    },
    "samesite": {
      "type": "string",
      "description": "Configures the SameSite attribute on session affinity cookie. Value \"Auto\" will be translated to \"Lax\" or \"None\" depending if Always Use HTTPS is enabled. Note: when using value \"None\", the secure attribute can not be set to \"Never\".",
      "enum": [
        "Auto",
        "Lax",
        "None",
        "Strict"
      ],
      "default": "Auto"
    },
    "secure": {
      "type": "string",
      "description": "Configures the Secure attribute on session affinity cookie. Value \"Always\" indicates the Secure attribute will be set in the Set-Cookie header, \"Never\" indicates the Secure attribute will not be set, and \"Auto\" will set the Secure attribute depending if Always Use HTTPS is enabled.",
      "enum": [
        "Auto",
        "Always",
        "Never"
      ],
      "default": "Auto"
    },
    "zero_downtime_failover": {
      "type": "string",
      "description": "Configures the zero-downtime failover between origins within a pool when session affinity is enabled. This feature is currently incompatible with Argo, Tiered Cache, and Bandwidth Alliance. The supported values are:\n- `\"none\"`: No failover takes place for sessions pinned to the origin (default).\n- `\"temporary\"`: Traffic will be sent to another other healthy origin until the originally pinned origin is available; note that this can potentially result in heavy origin flapping.\n- `\"sticky\"`: The session affinity cookie is updated and subsequent requests are sent to the new origin. Note: Zero-downtime failover with sticky sessions is currently not supported for session affinity by header.",
      "enum": [
        "none",
        "temporary",
        "sticky"
      ],
      "default": "none"
    }
  }
}