Skip to content
PaloNexus
Request access Request

Reference overview

The PaloNexus contract consists of its HTTP APIs, request and response headers, and component environment variables.

The two API planes

Section titled “The two API planes”

PaloNexus exposes its contracts on a small number of listeners (ext_authz below is Envoy’s external-authorization hook — the filter that calls the decision plane):

PlaneListenerServed byReference
Decision (ext_authz):9191 /authzcontrol-planeHTTP API
Egress forward-proxy:9092 (HTTP proxy)control-planeHTTP API
Management:8181 (registry, audit, egress requests, /metrics)control-planeHTTP API
Identity:8090 (agents, delegations, revocation, VP verify)agent-idpHTTP API
Enterprise IAM:8090 (directory sync, employee identity, governance, authority delegations, revocation, the Security Token Service, STS)agent-idpEnterprise IAM API
Model broker:8080 (OpenAI-compatible)model-broker (LiteLLM)HTTP API

Headers

Section titled “Headers”

The decision is shaped by — and produces — a set of X-Palonexus-* headers, plus the Proxy-Authorization Verifiable Presentation (VP) at the egress proxy. The presence of X-Palonexus-Actor is what selects the egress decision path. See Headers.

Environment variables

Section titled “Environment variables”

Every component is configured entirely by environment variables — the same image runs everywhere; only the Kustomize overlay changes. AGENT_IDENTITY_MODE, REGISTRY_BACKEND/REGISTRY_DB_URL, OIDC_*, EGRESS_PROXY_ADDR, and the agent-idp IDP_* vars are the load-bearing ones. See Environment variables.

See also

Section titled “See also”