{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/nexus/json-schema/nexus-docker-proxy-api-repository-schema.json",
  "title": "DockerProxyApiRepository",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/nexus-repository-management-api-openapi.yml#/components/schemas/DockerProxyApiRepository",
  "required": [
    "docker",
    "dockerProxy",
    "format",
    "httpClient",
    "name",
    "negativeCache",
    "online",
    "proxy",
    "storage",
    "type"
  ],
  "type": "object",
  "properties": {
    "name": {
      "minLength": 1,
      "pattern": "^[a-zA-Z0-9\\-]{1}[a-zA-Z0-9_\\-\\.]*$",
      "type": "string",
      "description": "A unique identifier for this repository"
    },
    "url": {
      "type": "string",
      "description": "URL to the repository"
    },
    "online": {
      "type": "boolean",
      "description": "Whether this repository accepts incoming requests"
    },
    "storage": {
      "$ref": "#/$defs/StorageAttributes"
    },
    "cleanup": {
      "$ref": "#/$defs/CleanupPolicyAttributes"
    },
    "docker": {
      "$ref": "#/$defs/DockerAttributes"
    },
    "dockerProxy": {
      "$ref": "#/$defs/DockerProxyAttributes"
    },
    "proxy": {
      "$ref": "#/$defs/ProxyAttributes"
    },
    "negativeCache": {
      "$ref": "#/$defs/NegativeCacheAttributes"
    },
    "httpClient": {
      "$ref": "#/$defs/HttpClientAttributes"
    },
    "routingRuleName": {
      "type": "string",
      "description": "The name of the routing rule assigned to this repository"
    },
    "replication": {
      "$ref": "#/$defs/ReplicationAttributes"
    },
    "format": {
      "minLength": 1,
      "type": "string",
      "description": "Component format held in this repository"
    },
    "type": {
      "minLength": 1,
      "type": "string",
      "description": "Controls if deployments of and updates to artifacts are allowed"
    },
    "firewall": {
      "$ref": "#/$defs/FirewallAttributes"
    }
  },
  "$defs": {
    "CleanupPolicyAttributes": {
      "type": "object",
      "properties": {
        "policyNames": {
          "type": "array",
          "description": "Components that match any of the applied policies will be deleted",
          "items": {
            "type": "string",
            "description": "Components that match any of the applied policies will be deleted"
          }
        }
      }
    },
    "DockerAttributes": {
      "required": [
        "forceBasicAuth",
        "v1Enabled"
      ],
      "type": "object",
      "properties": {
        "v1Enabled": {
          "type": "boolean",
          "description": "Whether to allow clients to use the V1 API to interact with this repository"
        },
        "forceBasicAuth": {
          "type": "boolean",
          "description": "Whether to force authentication (Docker Bearer Token Realm required if false)"
        },
        "httpPort": {
          "type": "integer",
          "description": "Create an HTTP connector at specified port",
          "format": "int32"
        },
        "httpsPort": {
          "type": "integer",
          "description": "Create an HTTPS connector at specified port",
          "format": "int32"
        },
        "subdomain": {
          "type": "string",
          "description": "Allows to use subdomain"
        },
        "pathEnabled": {
          "type": "boolean",
          "description": "Allows to use repository name in Docker image paths"
        }
      }
    },
    "DockerProxyAttributes": {
      "required": [
        "indexType"
      ],
      "type": "object",
      "properties": {
        "indexType": {
          "minLength": 1,
          "type": "string",
          "description": "Type of Docker Index",
          "enum": [
            "HUB",
            "REGISTRY",
            "CUSTOM"
          ]
        },
        "indexUrl": {
          "type": "string",
          "description": "Url of Docker Index to use"
        },
        "cacheForeignLayers": {
          "type": "boolean",
          "description": "Allow Nexus Repository Manager to download and cache foreign layers"
        },
        "foreignLayerUrlWhitelist": {
          "type": "array",
          "description": "Regular expressions used to identify URLs that are allowed for foreign layer requests",
          "items": {
            "type": "string",
            "description": "Regular expressions used to identify URLs that are allowed for foreign layer requests"
          }
        },
        "ecrAuth": {
          "$ref": "#/$defs/EcrAuthAttributes"
        },
        "layerDownloadTimeoutMinutes": {
          "maximum": 1440,
          "minimum": 1,
          "type": "integer",
          "description": "Maximum time to wait for each container image layer to download during Firewall scanning (minutes)",
          "format": "int32"
        }
      }
    },
    "EcrAuthAttributes": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Whether AWS ECR authentication is enabled for this proxy repository"
        },
        "awsRegion": {
          "type": "string",
          "description": "AWS region of the ECR registry (e.g. us-east-1)"
        },
        "registryId": {
          "type": "string",
          "description": "12-digit AWS account ID hosting the ECR registry"
        },
        "accessKeyId": {
          "type": "string",
          "description": "AWS access key ID used to authenticate to ECR"
        },
        "secretAccessKey": {
          "type": "string",
          "description": "AWS secret access key used to authenticate to ECR; never returned by the API",
          "writeOnly": true
        },
        "sessionToken": {
          "type": "string",
          "description": "Optional AWS session token for short-lived (STS) credentials; never returned by the API",
          "writeOnly": true
        }
      },
      "description": "AWS ECR authentication configuration"
    },
    "FirewallAttributes": {
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "description": "Firewall mode (DISABLED, AUDIT, QUARANTINE, or PCCS)",
          "enum": [
            "DISABLED",
            "AUDIT",
            "QUARANTINE",
            "PCCS"
          ]
        }
      }
    },
    "HttpClientAttributes": {
      "type": "object",
      "properties": {
        "blocked": {
          "type": "boolean",
          "description": "Whether to block outbound connections on the repository"
        },
        "autoBlock": {
          "type": "boolean",
          "description": "Whether to auto-block outbound connections if remote peer is detected as unreachable/unresponsive"
        },
        "connection": {
          "$ref": "#/$defs/HttpClientConnectionAttributes"
        },
        "authentication": {
          "$ref": "#/$defs/HttpClientConnectionAuthenticationAttributes"
        }
      }
    },
    "HttpClientConnectionAttributes": {
      "type": "object",
      "properties": {
        "retries": {
          "maximum": 10,
          "minimum": 0,
          "type": "integer",
          "description": "Total retries if the initial connection attempt suffers a timeout",
          "format": "int32"
        },
        "userAgentSuffix": {
          "type": "string",
          "description": "Custom fragment to append to User-Agent header in HTTP requests"
        },
        "timeout": {
          "maximum": 3600,
          "minimum": 1,
          "type": "integer",
          "description": "Seconds to wait for activity before stopping and retrying the connection",
          "format": "int32"
        },
        "enableCircularRedirects": {
          "type": "boolean",
          "description": "Whether to enable redirects to the same location (may be required by some servers)"
        },
        "enableCookies": {
          "type": "boolean",
          "description": "Whether to allow cookies to be stored and used"
        },
        "useTrustStore": {
          "type": "boolean",
          "description": "Use certificates stored in the Nexus Repository Manager truststore to connect to external systems"
        }
      }
    },
    "HttpClientConnectionAuthenticationAttributes": {
      "required": [
        "type"
      ],
      "type": "object",
      "properties": {
        "type": {
          "minLength": 1,
          "type": "string",
          "description": "Authentication type"
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string",
          "writeOnly": true
        },
        "ntlmHost": {
          "type": "string"
        },
        "ntlmDomain": {
          "type": "string"
        },
        "bearerToken": {
          "type": "string",
          "writeOnly": true
        }
      }
    },
    "NegativeCacheAttributes": {
      "required": [
        "enabled",
        "timeToLive"
      ],
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Whether to cache responses for content not present in the proxied repository"
        },
        "timeToLive": {
          "type": "integer",
          "description": "How long to cache the fact that a file was not found in the repository (in minutes)",
          "format": "int32"
        }
      }
    },
    "ProxyAttributes": {
      "required": [
        "contentMaxAge",
        "metadataMaxAge",
        "remoteUrl"
      ],
      "type": "object",
      "properties": {
        "remoteUrl": {
          "minLength": 1,
          "type": "string",
          "description": "Location of the remote repository being proxied"
        },
        "contentMaxAge": {
          "type": "integer",
          "description": "How long to cache artifacts before rechecking the remote repository (in minutes)",
          "format": "int32"
        },
        "metadataMaxAge": {
          "type": "integer",
          "description": "How long to cache metadata before rechecking the remote repository (in minutes)",
          "format": "int32"
        },
        "preserveEncodedCharacters": {
          "type": "boolean",
          "description": "When true, preserves encoded characters like %2B (plus), %23 (hash), and %20 (space) in their encoded form when proxying to the remote repository. Enable this when proxying to AWS S3, Cloudflare CDN, or Azure Blob Storage, which require encoded characters to remain encoded. When false (default), uses standard encoding that preserves literal + characters (works for crates.io and most remotes). SECURITY NOTE: Only enable this for trusted remote repositories. Path traversal sequences (..) in redirects are automatically normalized."
        }
      }
    },
    "ReplicationAttributes": {
      "required": [
        "preemptivePullEnabled"
      ],
      "type": "object",
      "properties": {
        "preemptivePullEnabled": {
          "type": "boolean",
          "description": "Whether pre-emptive pull is enabled"
        },
        "assetPathRegex": {
          "type": "string",
          "description": "Regular Expression of Asset Paths to pull pre-emptively pull"
        }
      }
    },
    "StorageAttributes": {
      "required": [
        "blobStoreName",
        "strictContentTypeValidation"
      ],
      "type": "object",
      "properties": {
        "blobStoreName": {
          "type": "string",
          "description": "Blob store used to store repository contents"
        },
        "strictContentTypeValidation": {
          "type": "boolean",
          "description": "Whether to validate uploaded content's MIME type appropriate for the repository format"
        }
      }
    }
  }
}