docs: security features sweep — IP Restrictions page, threat protection billing fix, OpenAPI override schema - #1114
Merged
Merged
Conversation
Documents the per-team API key IP allowlist: IPv4/IPv6/CIDR entries, enforcement at authentication across all API surfaces, the 403/500 error behavior, and the empty-list = unrestricted rule. Linked from the enterprise page and the Key Restrictions page, registered in nav. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…de rule Crawls and batch scrapes bill +2 per scraped page (each page job scans afresh; verdicts are never reused across jobs), not per unique domain — only search and map dedupe by domain within a request. Also documents that enforced (forced) threat protection rejects overrides that set mode to off, and adds the matching error-reference row. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…OpenAPI The override object was described in prose on the feature page but missing from the request schemas. Adds a ThreatProtectionOverride component to both specs and references it where the API accepts it: shared scrape options (scrape, batch scrape, crawl/search scrapeOptions) plus top-level on map, extract, search, and agent (v2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The allowlist itself is team-scoped; the enterprise feature flag lives on the organization, matching the Key Restrictions page wording. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sweep of the docs against the recently shipped security/enterprise API features. Three gaps found and fixed:
1. IP Restrictions had no documentation
The per-team API key IP allowlist shipped with only a one-line bullet on the enterprise page. Adds
features/ip-restrictions.mdxcovering:Linked from
enterprise.mdxand the Key Restrictions page; registered in nav (English blocks only — locadex handles locales).2. Threat protection billing docs were wrong for crawls
The feature page claimed crawl/search/map scan fees scale with unique domains, not pages. Per the billing implementation and its snips (
scrape-billing.ts,threat-protection-billing.test.ts: "crawl bills base + 2 per scraped document", "batch scrape bills base + 2 per document (each job scans afresh)"), crawls and batch scrapes scan every page independently — verdicts are never reused across page jobs (ZDR, no verdict cache). Only search and map dedupe by domain within a request. Rewrote the billing bullets accordingly, and documented the redirect dedup rule.Also documents the
forcedmode rule (overrides may not setmode: "off") with its error-reference row.3. Per-request
threatProtectionoverride missing from OpenAPIThe feature page describes the per-request override object, but no request schema defined it. Adds a
ThreatProtectionOverridecomponent to both specs and references it exactly where the API accepts it:ScrapeOptions(covers scrape, batch scrape, crawl/searchscrapeOptions) + top-level on/map,/extract,/agent,/searchBaseScrapeOptions+ top-level on/map,/extract,/searchv1 spec edited via Prettier-clean surgery (60 pure insertions, no reflow).
Explicitly not covered
ip-restriction-cache-clear,key-restriction-cache-clear): internal, BULL_AUTH_KEY-gated — intentionally undocumented.🤖 Generated with Claude Code