{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/stackit/main/json-schema/stackit-update-load-balancer-payload-schema.json",
  "title": "UpdateLoadBalancerPayload",
  "x-generated": "2026-10-18",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/stackit-alb-openapi.yml#/components/schemas/UpdateLoadBalancerPayload",
  "properties": {
    "disableTargetSecurityGroupAssignment": {
      "description": "Disable target security group assignemt to allow targets outside of the given network. Connectivity to targets need to be ensured by the customer, including routing and Security Groups (targetSecurityGroup can be assigned). Not changeable after creation.",
      "type": "boolean"
    },
    "errors": {
      "description": "Reports all errors a Application Load Balancer has.",
      "items": {
        "$ref": "#/$defs/LoadBalancerError"
      },
      "readOnly": true,
      "type": "array"
    },
    "externalAddress": {
      "description": "The external IP address where this Application Load Balancer is exposed. Not changeable after creation.",
      "type": "string"
    },
    "labels": {
      "additionalProperties": {
        "type": "string"
      },
      "description": "Labels represent user-defined metadata as key-value pairs.\nLabel count should not exceed 64 per ALB.\n\n**Key Formatting Rules:**\nLength: 1-63 characters.\nCharacters: Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between.\nKeys starting with 'stackit-' are system-reserved; users MUST NOT manage them.\n\n**Value Formatting Rules:**\nLength: 0-63 characters (empty string explicitly allowed).\nCharacters (for non-empty values): Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between.\n",
      "type": "object"
    },
    "listeners": {
      "description": "There is a maximum listener count of 20.\n\n",
      "items": {
        "$ref": "#/$defs/Listener"
      },
      "title": "List of all listeners which will accept traffic.",
      "type": "array"
    },
    "loadBalancerSecurityGroup": {
      "allOf": [
        {
          "$ref": "#/$defs/SecurityGroup"
        }
      ],
      "description": "Security Group permitting network traffic from the LoadBalancer to the targets. Useful when disableTargetSecurityGroupAssignment=true to manually assign target security groups to targets.",
      "readOnly": true
    },
    "name": {
      "description": "Application Load Balancer name. Not changeable after creation.",
      "pattern": "^[0-9a-z](?:(?:[0-9a-z]|-){0,61}[0-9a-z])?$",
      "type": "string"
    },
    "networks": {
      "description": "List of networks that listeners and targets reside in. Currently limited to one. Not changeable after creation.",
      "items": {
        "$ref": "#/$defs/Network"
      },
      "type": "array"
    },
    "options": {
      "$ref": "#/$defs/LoadBalancerOptions"
    },
    "planId": {
      "description": "Service Plan configures the size of the Application Load Balancer. Currently supported plan is p10. This list can change in the future where plan ids will be removed and new plans by added. That is the reason this is not an enum.",
      "type": "string"
    },
    "privateAddress": {
      "description": "Transient private Application Load Balancer IP address that can change any time.",
      "readOnly": true,
      "type": "string"
    },
    "region": {
      "description": "Region of the LoadBalancer.",
      "readOnly": true,
      "type": "string"
    },
    "status": {
      "enum": [
        "STATUS_UNSPECIFIED",
        "STATUS_PENDING",
        "STATUS_READY",
        "STATUS_ERROR",
        "STATUS_TERMINATING"
      ],
      "readOnly": true,
      "type": "string"
    },
    "targetPools": {
      "description": "List of all target pools which will be used in the Application Load Balancer. Limited to 20.",
      "items": {
        "$ref": "#/$defs/TargetPool"
      },
      "type": "array"
    },
    "targetSecurityGroup": {
      "allOf": [
        {
          "$ref": "#/$defs/SecurityGroup"
        }
      ],
      "description": "Security Group that allows the targets to receive traffic from the LoadBalancer. Useful when disableTargetSecurityGroupAssignment=true to manually assign target security groups to targets.",
      "readOnly": true
    },
    "version": {
      "description": "Application Load Balancer resource version.\nMust be empty or unset for creating Application Load Balancers, non-empty for updating. Semantics:\nWhile retrieving, this is the current version of this Application Load Balancer resource that changes during updates. On updates this field specified the Application Load Balancer version you calculated your update for instead of the future version to enable concurrency safe updates. Update calls will then report the new version in their result as you would see with a Application Load Balancer retrieval call later. There exist no total order of the version, so you can only compare it for equality, but not for less/greater than another version. Since the creation of Application Load Balancer is always intended to create the first version of it, there should be no existing version. That's why this field must by empty of not present in that case.",
      "type": "string"
    }
  },
  "type": "object",
  "$defs": {
    "ActiveHealthCheck": {
      "description": "Set this to customize active health checks for targets in this pool.",
      "properties": {
        "altPort": {
          "description": "Overrides the default port used for health check probes.",
          "format": "int32",
          "title": "Health Check Port",
          "type": "integer"
        },
        "healthyThreshold": {
          "description": "Healthy threshold of the health checking",
          "format": "int32",
          "minimum": 1,
          "title": "Healthy threshold",
          "type": "integer"
        },
        "httpHealthChecks": {
          "$ref": "#/$defs/HttpHealthChecks"
        },
        "interval": {
          "description": "Interval duration of health checking in seconds",
          "pattern": "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$",
          "title": "Interval",
          "type": "string"
        },
        "intervalJitter": {
          "description": "Interval duration threshold of the health checking in seconds",
          "pattern": "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$",
          "title": "Interval threshold",
          "type": "string"
        },
        "timeout": {
          "description": "Active health checking timeout duration in seconds",
          "pattern": "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$",
          "title": "Timeout",
          "type": "string"
        },
        "unhealthyThreshold": {
          "description": "Unhealthy threshold of the health checking",
          "format": "int32",
          "minimum": 1,
          "title": "Unhealthy threshold",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "CertificateConfig": {
      "description": "TLS termination certificate configuration.",
      "properties": {
        "certificateIds": {
          "description": "Certificate IDs for TLS termination.",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "CookiePersistence": {
      "description": "CookiePersistence contains the cookie-based session persistence configuration.",
      "properties": {
        "name": {
          "description": "Cookie is the name of the cookie to use.",
          "type": "string"
        },
        "ttl": {
          "description": "TTL specifies the time-to-live for the cookie.\nThe default value is 0s, and it acts as a session cookie, expiring when the client session ends.\n",
          "pattern": "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$",
          "title": "TTL (Time-to-live)",
          "type": "string"
        }
      },
      "type": "object"
    },
    "HostConfig": {
      "properties": {
        "host": {
          "description": "Hostname to match. Supports wildcards (e.g. *.example.com).",
          "type": "string"
        },
        "rules": {
          "description": "Routing rules under the specified host, matched by path prefix.",
          "items": {
            "$ref": "#/$defs/Rule"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "HttpHeader": {
      "properties": {
        "exactMatch": {
          "description": "Exact match for the header value.",
          "type": "string"
        },
        "name": {
          "description": "Header name.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "HttpHealthChecks": {
      "description": "Options for the HTTP health checking.",
      "properties": {
        "okStatuses": {
          "description": "List of HTTP status codes that indicate a healthy response",
          "items": {
            "type": "string"
          },
          "maximum": 299,
          "minimum": 200,
          "title": "HTTP Health Checks' status code",
          "type": "array"
        },
        "path": {
          "description": "Path to send the health check request to",
          "type": "string"
        },
        "tls": {
          "$ref": "#/$defs/TlsConfig"
        }
      },
      "type": "object"
    },
    "Listener": {
      "properties": {
        "http": {
          "$ref": "#/$defs/ProtocolOptionsHTTP"
        },
        "https": {
          "$ref": "#/$defs/ProtocolOptionsHTTPS"
        },
        "name": {
          "description": "A unique listener name.",
          "pattern": "^[0-9a-z](?:(?:[0-9a-z]|-){0,61}[0-9a-z])?$",
          "type": "string"
        },
        "port": {
          "description": "Port number on which the listener receives incoming traffic.",
          "format": "int32",
          "maximum": 65535,
          "minimum": 1,
          "type": "integer"
        },
        "protocol": {
          "description": "Protocol is the highest network protocol we understand to load balance. Currently PROTOCOL_HTTP and PROTOCOL_HTTPS are supported.",
          "enum": [
            "PROTOCOL_UNSPECIFIED",
            "PROTOCOL_HTTP",
            "PROTOCOL_HTTPS"
          ],
          "type": "string"
        },
        "wafConfigName": {
          "description": "Enable Web Application Firewall (WAF), referenced by name. See \"Application Load Balancer - Web Application Firewall API\" for more information.",
          "pattern": "^[0-9a-z](?:(?:[0-9a-z]|-){0,61}[0-9a-z])?$",
          "type": "string"
        }
      },
      "type": "object"
    },
    "LoadBalancerError": {
      "properties": {
        "description": {
          "description": "The error description contains additional helpful user information to fix the error state of the Application Load Balancer. For example the IP 45.135.247.139 does not exist in the project, then the description will report: Floating IP \"45.135.247.139\" could not be found.",
          "type": "string"
        },
        "type": {
          "description": "The error type specifies which part of the Application Load Balancer encountered the error. I.e. the API will not check if a provided public IP is actually available in the project. Instead the Application Load Balancer with try to use the provided IP and if not available reports TYPE_FIP_NOT_CONFIGURED error.",
          "enum": [
            "TYPE_UNSPECIFIED",
            "TYPE_INTERNAL",
            "TYPE_QUOTA_SECGROUP_EXCEEDED",
            "TYPE_QUOTA_SECGROUPRULE_EXCEEDED",
            "TYPE_PORT_NOT_CONFIGURED",
            "TYPE_FIP_NOT_CONFIGURED",
            "TYPE_TARGET_NOT_ACTIVE",
            "TYPE_METRICS_MISCONFIGURED",
            "TYPE_LOGS_MISCONFIGURED",
            "TYPE_FIP_NOT_FOUND",
            "TYPE_IP_EXHAUSTED",
            "TYPE_DNS_NOT_CONFIGURED",
            "TYPE_VM_PORT_NOT_CONFIGURED"
          ],
          "type": "string"
        }
      },
      "type": "object"
    },
    "LoadBalancerOptions": {
      "description": "Defines any optional functionality you want to have enabled on your Application Load Balancer.",
      "properties": {
        "accessControl": {
          "$ref": "#/$defs/LoadbalancerOptionAccessControl"
        },
        "ephemeralAddress": {
          "description": "This option automates the handling of the external IP address for an Application Load Balancer. If set to true a new IP address will be automatically created. It will also be automatically deleted when the Load Balancer is deleted.",
          "title": "Automatic external IP",
          "type": "boolean"
        },
        "observability": {
          "$ref": "#/$defs/LoadbalancerOptionObservability"
        },
        "privateNetworkOnly": {
          "description": "Application Load Balancer is accessible only via a private network ip address. Not changeable after creation.",
          "title": "Private Network Only",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "LoadbalancerOptionAccessControl": {
      "description": "Use this option to limit the IP ranges that can use the Application Load Balancer.\n `allowed_source_ranges` and `ip_block_list_name` may be set together. When both are set,\n `allowed_source_ranges` is evaluated first, then `ip_block_list_name` is evaluated.",
      "properties": {
        "allowedSourceRanges": {
          "description": "Application Load Balancer is accessible only from an IP address in this range. May be combined with `ipBlockListName`; `allowedSourceRanges` is evaluated first, then `ipBlockListName`.",
          "items": {
            "type": "string"
          },
          "title": "Application Load Balancer source ranges",
          "type": "array"
        },
        "ipBlockListName": {
          "description": "Reference to an IP block list by name. Traffic originating from any IP in the referenced list is denied access to the Application Load Balancer. See \"IP Lists API\" for how to manage IP block lists. May be combined with `allowedSourceRanges`; `allowedSourceRanges` is evaluated first, then `ipBlockListName`.",
          "pattern": "^[0-9a-z](?:(?:[0-9a-z]|-){0,49}[0-9a-z])?$",
          "title": "IP block list reference",
          "type": "string"
        }
      },
      "type": "object"
    },
    "LoadbalancerOptionLogs": {
      "description": "Observability logs configuration.",
      "properties": {
        "credentialsRef": {
          "description": "Credentials reference for logging. This reference is created via the observability create endpoint and the credential needs to contain the basic auth username and password for the logging solution the push URL points to. Then this enables monitoring via remote write for the Application Load Balancer.",
          "title": "Credentials reference",
          "type": "string"
        },
        "pushUrl": {
          "description": "The Observability(Logs)/Loki remote write Push URL you want the logs to be shipped to.",
          "title": "Push URL",
          "type": "string"
        }
      },
      "type": "object"
    },
    "LoadbalancerOptionMetrics": {
      "description": "Observability metrics configuration.",
      "properties": {
        "credentialsRef": {
          "description": "Credentials reference for metrics. This reference is created via the observability create endpoint and the credential needs to contain the basic auth username and password for the metrics solution the push URL points to. Then this enables monitoring via remote write for the Application Load Balancer.",
          "title": "Credentials reference",
          "type": "string"
        },
        "pushUrl": {
          "description": "The Observability(Metrics)/Prometheus remote write push URL you want the metrics to be shipped to.",
          "title": "Push URL",
          "type": "string"
        }
      },
      "type": "object"
    },
    "LoadbalancerOptionObservability": {
      "description": "We offer Load Balancer observability via STACKIT Observability or external solutions.",
      "properties": {
        "logs": {
          "$ref": "#/$defs/LoadbalancerOptionLogs"
        },
        "metrics": {
          "$ref": "#/$defs/LoadbalancerOptionMetrics"
        }
      },
      "type": "object"
    },
    "Network": {
      "properties": {
        "networkId": {
          "description": "STACKIT network ID the Application Load Balancer and/or targets are in.",
          "format": "uuid",
          "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$",
          "type": "string"
        },
        "role": {
          "description": "The role defines how the Application Load Balancer is using the network. Currently only ROLE_LISTENERS_AND_TARGETS is supported.",
          "enum": [
            "ROLE_UNSPECIFIED",
            "ROLE_LISTENERS_AND_TARGETS",
            "ROLE_LISTENERS",
            "ROLE_TARGETS"
          ],
          "type": "string"
        }
      },
      "type": "object"
    },
    "Path": {
      "description": "Path match. Optional. Contains either an exact or prefix match. If not set, defaults to root path '/' of prefix type. Cannot be set if 'path_prefix' is used. Prefer using this field over 'path_prefix'.",
      "properties": {
        "exactMatch": {
          "description": "Exact path match. Only a request path exactly equal to the value will match, e.g. '/foo' matches only '/foo', not '/foo/bar' or '/foobar'.",
          "type": "string"
        },
        "prefix": {
          "description": "Prefix path match. Only matches on full segment boundaries, e.g. '/foo' matches '/foo' and '/foo/bar' but NOT '/foobar'.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ProtocolOptionsHTTP": {
      "description": "Configuration for handling HTTP traffic on this listener.",
      "properties": {
        "hosts": {
          "description": "Defines routing rules grouped by hostname.",
          "items": {
            "$ref": "#/$defs/HostConfig"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "ProtocolOptionsHTTPS": {
      "description": "Configuration for handling HTTPS traffic on this listener.",
      "properties": {
        "certificateConfig": {
          "$ref": "#/$defs/CertificateConfig"
        }
      },
      "type": "object"
    },
    "QueryParameter": {
      "properties": {
        "exactMatch": {
          "description": "Exact match for the parameter value.",
          "type": "string"
        },
        "name": {
          "description": "Parameter name.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "Rule": {
      "properties": {
        "cookiePersistence": {
          "$ref": "#/$defs/CookiePersistence"
        },
        "headers": {
          "description": "Headers for the rule.",
          "items": {
            "$ref": "#/$defs/HttpHeader"
          },
          "type": "array"
        },
        "path": {
          "$ref": "#/$defs/Path"
        },
        "queryParameters": {
          "description": "Query parameters for the rule.",
          "items": {
            "$ref": "#/$defs/QueryParameter"
          },
          "type": "array"
        },
        "targetPool": {
          "description": "Reference target pool by target pool name.",
          "type": "string"
        },
        "webSocket": {
          "description": "If enabled, when client sends an HTTP request with and Upgrade header, indicating the desire to establish a Websocket connection, \nif backend server supports WebSocket, it responds with HTTP 101 status code, switching protocols from HTTP to WebSocket.\nHence the client and the server can exchange data in real-time using one long-lived TCP connection.",
          "title": "WebSocket",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "SecurityGroup": {
      "properties": {
        "id": {
          "description": "ID of the security Group",
          "type": "string"
        },
        "name": {
          "description": "Name of the security Group",
          "type": "string"
        }
      },
      "type": "object"
    },
    "Target": {
      "properties": {
        "displayName": {
          "description": "Target display name.",
          "pattern": "^[0-9a-zA-Z](?:(?:[0-9a-zA-Z]|-){0,61}[0-9a-zA-Z])?$",
          "type": "string"
        },
        "ip": {
          "description": "Private target IP, which must by unique within a target pool.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "TargetPool": {
      "properties": {
        "activeHealthCheck": {
          "$ref": "#/$defs/ActiveHealthCheck"
        },
        "name": {
          "description": "Target pool name",
          "pattern": "^[0-9a-z](?:(?:[0-9a-z]|-){0,61}[0-9a-z])?$",
          "type": "string"
        },
        "targetPort": {
          "description": "The number identifying the port where each target listens for traffic.",
          "format": "int32",
          "maximum": 65535,
          "minimum": 1,
          "type": "integer"
        },
        "targets": {
          "description": "List of all targets which will be used in the pool. Limited to 250.",
          "items": {
            "$ref": "#/$defs/Target"
          },
          "type": "array"
        },
        "tlsConfig": {
          "$ref": "#/$defs/TlsConfig"
        }
      },
      "type": "object"
    },
    "TlsConfig": {
      "description": "Set this to configure TLS settings.",
      "properties": {
        "customCa": {
          "description": "Specifies a custom Certificate Authority (CA). When provided, the target pool will trust certificates signed by this CA, in addition to any system-trusted CAs. This is useful for scenarios where the target pool needs to communicate with servers using self-signed or internally-issued certificates. Enabled needs to be set to true and skip validation to false for this option.",
          "format": "bytes",
          "title": "Custom Certificate Authority",
          "type": "string"
        },
        "enabled": {
          "description": "Enable TLS (Transport Layer Security) bridging for the connection between Application Load Balancer and targets in this pool. When enabled, public CAs are trusted. Can be used in tandem with the options either custom CA or skip validation or alone.",
          "title": "Enabled",
          "type": "boolean"
        },
        "skipCertificateValidation": {
          "description": "Bypass certificate validation for TLS bridging in this target pool. This option is insecure and can only be used with public CAs by setting enabled true. Meant to be used for testing purposes only!",
          "title": "Skip Certificate Validation",
          "type": "boolean"
        }
      },
      "type": "object"
    }
  }
}