---
schema_version: "1"
id: 7462645c83b1d133e69edb9a34cc1034141f637498c27967c2d1996782356bb7
title: External Processing Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-external-processing.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-external-processing
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 779cf5bf6cd401360fa6e6acc8cb041fe5e4ad1297acd99743f6652764e22aa1
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: external processing, processing, flex gateway, gateway, policy
---

# External Processing Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>External Processing</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Sends the incoming HTTP requests or outgoing HTTP responses requests to an external gRPC service for additional processing</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Transformation</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.6.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/external-processing-release-notes">External Processing</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>403 - IP is rejected</p></td></tr></tbody></table>

## Summary

The External Processing policy forwards the incoming HTTP request or outgoing HTTP response to an
external gRPC service to modify the headers, trailers, body, or any combination of the three. You
can also configure this policy to process either the request, response, or both.

Additionally, the external processing service can request different parts of the HTTP request or
response after the initial gRPC request was sent by Omni Gateway to the external processing server.
This enables you to send the minimum amount of data necessary. For example, Omni Gateway can
initially send only the HTTP requests headers. Then, after some processing, the external processor
can request the HTTP request body or trailers from Omni Gateway.

The parameters you set for sending the HTTP headers, trailers, and body only configure what is
initially sent. The external processing service has access to all parts of the HTTP request or
response regardless of what is configured. Configure the parameters to send all of the information
that the processing service needs for every incoming HTTP request or response. For example, if the
processing service needs the headers for every request but only needs the body for some of the
requests, depending on the information found in the header, only configure the parameters to send
the headers.

The External Processing policy is an extension of the External Processing filter native to Envoy. To
learn more about the External Processing filter, see
[External Processing Filter](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_proc/v3/ext_proc.proto).
Not all External Processing filter parameters are available for the External Processing policy. To
find what parameters are configurable, see
[Configuring Policy Parameters](#configuring-policy-parameters).

> [!NOTE] If other policies modify the HTTP request or response, ensure that you order the policies
> depending on if these modification should be present when the request is sent to the processing
> service or upstream service. For more information about ordering policies, see
> [Ordering Policies](https://docs.mulesoft.com/gateway/1.13/policies-reorder).

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

```yaml
- policyRef:
    name: native-ext-proc-flex
  config:
    uri: <string> // REQUIRED
    messageTimeout: <integer> // OPTIONAL, default: 1000
    requestHeaderMode: <string> // OPTIONAL, default: "send"
    responseHeaderMode: <string> // OPTIONAL, default: "send"
    requestBodyMode: <string> // OPTIONAL, default: "none"
    responseBodyMode: <string> // OPTIONAL, default: "none"
    requestTrailerMode: <string> // OPTIONAL, default: "skip"
    responseTrailerMode: <string> // OPTIONAL, default: "skip"
    failureModeAllow: <boolean> // OPTIONAL, default: false
    maxMessageTimeout: <integer> // OPTIONAL, default: 0
    allowModeOverride: <boolean> // OPTIONAL, default: true
```

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>uri</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>External processing server URI. For gRPC type servers, define the URI as <code>\h2://&lt;ext.authz.com&gt;:&lt;port&gt;</code>.</p></div></div></td></tr><tr><td><div><div><p><code>messageTimeout</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>1000</code></p></div></div></td><td><div><div><p>Message timeout for the processing server in milliseconds.</p></div></div></td></tr><tr><td><div><div><p><code>maxMessageTimeout</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>0</p></div></div></td><td><div><div><p>Specifies the upper bound the processing server can override <code>messageTimeout</code>.</p></div></div></td></tr><tr><td><div><div><p><code>failureModeAllow</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>When <code>true</code>, if the gRPC stream prematurely closes or can’t be opened, request processing continues without error.</p></div></div></td></tr><tr><td><div><div><p><code>allowModeOverride</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>Enables the processing server to override the policy configuration. When <code>true</code>, the server can override the configuration of the <code>requestHeaderMode</code>, <code>responseHeaderMode</code>, <code>requestBodyMode</code>, <code>responseBodyMode</code>, <code>requestTrailerMode</code>, and <code>responseTrailerMode</code> parameters.</p></div></div></td></tr><tr><td><div><div><p><code>observabilityMode</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>When <code>true</code>, the configured headers, body, and trailers are sent to the external processing server and Omni Gateway doesn’t wait for a response from the processing server.</p></div></div></td></tr><tr><td><div><div><p><code>requestHeaderMode</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>send</code></p></div></div></td><td><div><div><p>Whether the HTTP requests headers are sent to the processing service. Supported values are <code>send</code> and <code>skip</code>.</p></div></div></td></tr><tr><td><div><div><p><code>responseHeaderMode</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>send</code></p></div></div></td><td><div><div><p>Whether the HTTP response headers are sent to the processing service. Supported values are <code>send</code> and <code>skip</code>.</p></div></div></td></tr><tr><td><div><div><p><code>requestBodyMode</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>none</code></p></div></div></td><td><div><div><p>Mode that the HTTP request body is sent in. Supported values are <code>none</code>, <code>streamed</code>, <code>buffered</code>, and <code>bufferedPartial</code>. Selecting <code>none</code> does not send the request body.</p></div></div></td></tr><tr><td><div><div><p><code>responseBodyMode</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>none</code></p></div></div></td><td><div><div><p>Mode that the HTTP response body is sent in. Supported values are <code>none</code>, <code>streamed</code>, <code>buffered</code>, and <code>bufferedPartial</code>. Selecting <code>none</code> does not send the request body.</p></div></div></td></tr><tr><td><div><div><p><code>requestTrailerMode</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>skip</code></p></div></div></td><td><div><div><p>Whether the HTTP requests' trailer headers are sent to the processing service. Supported values are <code>send</code> and <code>skip</code>.</p></div></div></td></tr><tr><td><div><div><p><code>responseTrailerMode</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>skip</code></p></div></div></td><td><div><div><p>Whether the HTTP response trailer headers are sent to the processing service. Supported values are <code>send</code> and <code>skip</code>.</p></div></div></td></tr></tbody></table>

> [!NOTE] Leaving a value blank configures the parameter with the default value. If a required
> parameter doesn’t have a default value, you must configure the parameter.

#### Resource Configuration Example

This configuration streams the request headers, trailers, and body to the external processing
server. This configuration does not send any part of the response to the external processing server.

```yaml
- policyRef:
    name: native-ext-proc-flex
  config:
    uri: h2://<ext.authz.com>:<port>
    messageTimeout: <integer> // OPTIONAL
    responseHeaderMode: skip
    requestBodyMode: streamed
    responseTrailerMode: skip
```

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>External processing server URI</p></div></div></td><td><div><div><p>External processing server URI. For gRPC type servers, define the URI as <code>\h2://&lt;ext.authz.com&gt;:&lt;port&gt;</code>.</p></div></div></td></tr><tr><td><div><div><p>Message timeout</p></div></div></td><td><div><div><p>Message timeout for the processing server in milliseconds.</p></div></div></td></tr><tr><td><div><div><p>Max message timeout</p></div></div></td><td><div><div><p>Specifies the upper bound the processing server can override <strong>Message timeout</strong>.</p></div></div></td></tr><tr><td><div><div><p>Failure mode allow</p></div></div></td><td><div><div><p>When <code>true</code>, if the gRPC stream prematurely closes or can’t be opened, request processing continues without error.</p></div></div></td></tr><tr><td><div><div><p>Allow mode override</p></div></div></td><td><div><div><p>Enables the processing server to override the policy configuration. When <code>true</code>, the server can override the configuration of the <strong>Request header processing mode</strong>, <strong>Response header processing mode</strong>, <strong>Request body processing mode</strong>, <strong>Response body processing mode</strong>, <strong>Request trailer processing mode</strong>, and <strong>Response trailer processing mode</strong> parameters.</p></div></div></td></tr><tr><td><div><div><p>Observability mode</p></div></div></td><td><div><div><p>If enabled, the configured headers, body, and trailers are sent to the external processing server and Omni Gateway doesn’t wait for a response from the processing server.</p></div></div></td></tr><tr><td><div><div><p>Request header processing mode</p></div></div></td><td><div><div><p>Whether the requests headers are sent to the processing service.</p></div></div></td></tr><tr><td><div><div><p>Response header processing mode</p></div></div></td><td><div><div><p>Whether the response headers are sent to the processing service.</p></div></div></td></tr><tr><td><div><div><p>Request body processing mode</p></div></div></td><td><div><div><p>Mode that the request body is sent in.</p></div></div></td></tr><tr><td><div><div><p>Response body processing mode</p></div></div></td><td><div><div><p>Mode that the response body is sent in.</p></div></div></td></tr><tr><td><div><div><p>Request trailer processing mode</p></div></div></td><td><div><div><p>Whether the requests trailers are sent to the processing service.</p></div></div></td></tr><tr><td><div><div><p>Response trailer processing mode</p></div></div></td><td><div><div><p>Whether the response trailers are sent to the processing service.</p></div></div></td></tr></tbody></table>

> [!NOTE] Leaving a value blank configures the parameter with the default value. If a required
> parameter doesn’t have a default value, you must configure the parameter.

## How This Policy Works

The following diagram demonstrates the order in which requests and responses flow when the External
Processing policy is applied:

![A flowchart illustrating API interaction](/mulesoft/current/en-us/gateway/1.13/_images/ext-processing-policy.png)

1.  The client makes an HTTP request to Omni Gateway.

2.  Omni Gateway forwards the initial parts of the client HTTP request that you configure to the
    external processing service. If **Observability mode** is enabled, the next step is skipped.

3.  Omni Gateway awaits the modified client HTTP request. If **Allow mode override** is enabled, the
    external processing service can request additional parts of the request.

4.  Omni Gateway sends the client HTTP request to the upstream API service and awaits the HTTP
    response.

5.  Omni Gateway forwards the initial parts of the HTTP response that you configure to the external
    processing service. If **Observability mode** is enabled, the next step is skipped.

6.  Omni Gateway awaits the modified HTTP response. If **Allow mode override** is enabled, the
    external processing service can request additional parts of the HTTP response.

7.  Omni Gateway returns the modified HTTP response from the external processing service to the
    client.

By default, if Omni Gateway can’t establish a connection to the gRPC service or if the gRPC service
returns an error, the policy fails. To forward requests regardless of connection or error status,
enable the **Failure mode allow** parameter.