Crate chio_api_protect 

Zero-code reverse proxy that protects HTTP APIs with Chio signed receipts.

chio api protect reads an OpenAPI spec, generates a default Chio policy, and proxies all requests to the upstream API. Every request produces a signed HttpReceipt. Side-effect routes (POST/PUT/PATCH/DELETE) require a capability token; safe routes (GET/HEAD/OPTIONS) pass with audit receipts.

Sidecar control routes and production boundaries

The embedded sidecar exposes SDK helper routes under /v1/* and /chio/*. Not every route performs kernel-mediated authorization:

• POST /v1/evaluate/advisory signs an advisory ChioReceipt only. It checks local revocation and parameter-hash consistency; it does not validate capability scope or run the kernel guard pipeline. Successful responses set the chio-trust-level: advisory header and include authorization: false in the response body. Treat this route as observability, not as an allow/deny gate.
• POST /v1/capabilities/attenuate is a fail-closed control boundary. It returns HTTP 403 because attenuation requires the parent subject signer. Use the kernel delegation primitive or SDK-local signer helpers so that private key remains outside the sidecar.

See README.md for the full list of routes that are not production authorization paths.

Structs

EvaluationResult

Evaluated result for a single HTTP request.

ProtectConfig

Configuration for the protect proxy.

ProtectProxy

The protect proxy.

RequestEvaluator

The request evaluator holds the loaded route table and shared HTTP authority.

RouteEntry

Route information extracted from the OpenAPI spec.

Enums

ProtectError

Errors produced by the protect proxy.

Constants

DEFAULT_UPSTREAM_REQUEST_TIMEOUT

Default wall-clock ceiling on a single upstream proxy hop, including reading the full response body. Kept below the serve site’s drain window so an in-flight hop is resolved and receipted before a shutdown force-closes the connection.

Functions

discover_spec

Try to discover the OpenAPI spec from the upstream server.

load_spec_from_file

Load an OpenAPI spec from a file path or URL.