Enterprise Policies help organization admins enforce organization-wide security and management rules. Currently, Apidog supports the following enterprise policies:Enterprise Policies are only available for organizations with the Enterprise plan. Please also note that the enterprise policies available in the On-Premises deployment might be different than what is shown here.
Open Enterprise Policies#
To configure Enterprise Policies:1.
Go to Organization Settings.
2.
Navigate to the Security section.
3.
Select Enterprise Policies.
Only organization admins or owners can configure Enterprise Policies.
Auth Credential Policy#
Auth Credential Policy helps prevent sensitive authentication credentials from being saved or displayed in insecure ways.The policy applies to supported authentication fields when users edit or save API authentication, folder authentication, request authentication, security schemes, API test cases, and test scenarios.Policy options#
| Policy | Modes | Description |
|---|
| Forbid raw values in Auth sensitive fields | Off, Warn, Block | Controls whether users can save plaintext sensitive values in supported authentication fields. |
| Allow only local variables or Vault Secret in Auth | Off, Warn, Block | Controls whether sensitive authentication fields must use local-only variables or Vault Secret references. |
| Vault Secret cannot be revealed in plaintext | On, Off | Prevents Vault Secret values from being revealed in plaintext in the UI. |
Policy modes#
| Mode | Behavior |
|---|
| Off | The policy is not enforced. |
| Warn | Users are warned when a value does not comply, but saving is still allowed. |
| Block | Users cannot save values that do not comply. |
Supported authentication types and sensitive fields#
| Authentication type | Sensitive fields |
|---|
| API Key | Value |
| Bearer [REDACTED] | Token |
| Basic Auth | Password |
| Digest Auth | Password |
| OAuth 1.0 | Consumer Secret, Token Secret, Private Key |
| OAuth 2.0 | Access Token, Client Secret, Password |
| Hawk | Auth Key |
| AWS | Secret Key, Session Token |
| NTLM | Password |
| Akamai EdgeGrid | Access Token, Client Token, Client Secret |
| JWT Bearer | Secret, Private Key |
Combination authentication is also checked recursively.Allowed credential references#
When Auth Credential Policy is enabled, Apidog treats the following as allowed references:variable references, such as {{variableName}};
Vault Secret references, such as {{vault:key}}.
Invitation Reward Policy#
Invitation Reward Policy controls whether users can earn invitation rewards from invitations associated with the organization.When invitation rewards are enabled, eligible invitations can generate Credits for the inviter after the invited user successfully registers.When invitation rewards are disabled, eligible organization-related invitations no longer generate invitation reward Credits.Disabling invitation rewards does not remove Credits that have already been earned.
1.
Open Organization Settings.
2.
Go to Security > Enterprise Policies.
3.
Find Invitation Reward Policy.
4.
Enable or disable invitation rewards for the organization.
SSO Session Policy#
SSO Session Policy controls whether users can access My Teams while signed in through the organization's SSO.When Restrict My Teams in SSO sessions is enabled, users signed in through this organization's SSO cannot access My Teams. They must sign out and sign in separately to access it.When Restrict My Teams in SSO sessions is disabled, users signed in through this organization's SSO can access My Teams as usual.Restrict My Teams in SSO sessions is disabled by default. It can be enabled only if the organization has SSO configured.
1.
Open Organization Settings.
2.
Go to Security > Enterprise Policies.
4.
Enable or disable Restrict My Teams in SSO sessions.
{{OrgName}} SSO session. Switch sign-in methods to access it. Returning to {{OrgName}} requires SSO.Users can select Sign out and switch, then sign in with a non-SSO method to access My Teams. Returning to the organization requires SSO.Member Email Policy#
Member Email Policy controls which email domains can join the organization.Organization admins can configure one or more allowed email domains. A user can join the organization only if the user's final authenticated email belongs to an allowed domain.If the authenticated email does not belong to an allowed domain, Apidog rejects the invitation. Apidog does not create any Organization, Team, or Project membership. The rejected user does not occupy a seat and does not appear in the member list or member export.Apidog checks the user's final authenticated email, not only the email address used when the invitation was sent. Restricting resource access is not enough; disallowed emails cannot become organization members.
1.
Open Organization Settings.
2.
Configure allowed email domains.
3.
Go to Security > Enterprise Policies.
4.
Find Member Email Policy.
