diff --git a/data/priorities/ee/3.12.json b/data/priorities/ee/3.12.json
new file mode 100644
index 00000000..b2a264c0
--- /dev/null
+++ b/data/priorities/ee/3.12.json
@@ -0,0 +1,107 @@
+{
+  "pre-function": 1000000,
+  "app-dynamics": 999999,
+  "correlation-id": 100001,
+  "zipkin": 100000,
+  "exit-transformer": 9999,
+  "bot-detection": 2500,
+  "cors": 2000,
+  "jwe-decrypt": 1999,
+  "session": 1900,
+  "acme": 1705,
+  "oauth2-introspection": 1700,
+  "mtls-auth": 1600,
+  "degraphql": 1500,
+  "jwt": 1450,
+  "oauth2": 1400,
+  "vault-auth": 1350,
+  "key-auth": 1250,
+  "key-auth-enc": 1250,
+  "ldap-auth": 1200,
+  "ldap-auth-advanced": 1200,
+  "basic-auth": 1100,
+  "openid-connect": 1050,
+  "hmac-auth": 1030,
+  "jwt-signer": 1020,
+  "saml": 1010,
+  "header-cert-auth": 1009,
+  "json-threat-protection": 1009,
+  "xml-threat-protection": 1008,
+  "injection-protection": 1007,
+  "websocket-validator": 1006,
+  "websocket-size-limit": 1003,
+  "request-validator": 999,
+  "grpc-gateway": 998,
+  "tls-handshake-modifier": 997,
+  "tls-metadata-headers": 996,
+  "ip-restriction": 990,
+  "ace": 955,
+  "request-size-limiting": 951,
+  "acl": 950,
+  "opa": 920,
+  "service-protection": 915,
+  "rate-limiting": 910,
+  "rate-limiting-advanced": 910,
+  "ai-rate-limiting-advanced": 905,
+  "graphql-rate-limiting-advanced": 902,
+  "response-ratelimiting": 900,
+  "route-by-header": 850,
+  "oas-validation": 840,
+  "request-callout": 812,
+  "jq": 811,
+  "datakit": 810,
+  "request-transformer-advanced": 802,
+  "request-transformer": 801,
+  "response-transformer": 800,
+  "response-transformer-advanced": 800,
+  "ai-semantic-response-guard": 782,
+  "ai-aws-guardrails": 781,
+  "route-transformer-advanced": 780,
+  "redirect": 779,
+  "ai-rag-injector": 778,
+  "ai-request-transformer": 777,
+  "ai-sanitizer": 776,
+  "ai-semantic-prompt-guard": 775,
+  "ai-azure-content-safety": 774,
+  "ai-prompt-template": 773,
+  "ai-prompt-decorator": 772,
+  "ai-prompt-guard": 771,
+  "ai-proxy": 770,
+  "ai-proxy-advanced": 770,
+  "ai-prompt-compressor": 769,
+  "ai-response-transformer": 768,
+  "ai-llm-as-judge": 767,
+  "ai-semantic-cache": 765,
+  "ai-mcp-proxy": 764,
+  "standard-webhooks": 760,
+  "upstream-oauth": 760,
+  "solace-upstream": 755,
+  "confluent-consume": 754,
+  "kafka-consume": 753,
+  "confluent": 752,
+  "kafka-upstream": 751,
+  "aws-lambda": 750,
+  "azure-functions": 749,
+  "upstream-timeout": 400,
+  "proxy-cache": 100,
+  "proxy-cache-advanced": 100,
+  "graphql-proxy-cache-advanced": 99,
+  "forward-proxy": 50,
+  "canary": 20,
+  "opentelemetry": 14,
+  "prometheus": 13,
+  "http-log": 12,
+  "statsd": 11,
+  "statsd-advanced": 11,
+  "datadog": 10,
+  "file-log": 9,
+  "udp-log": 8,
+  "tcp-log": 7,
+  "loggly": 6,
+  "kafka-log": 5,
+  "syslog": 4,
+  "grpc-web": 3,
+  "request-termination": 2,
+  "mocking": -1,
+  "post-function": -1000
+}
\ No newline at end of file
diff --git a/data/referenceable_fields/3.12.json b/data/referenceable_fields/3.12.json
new file mode 100644
index 00000000..73ddde97
--- /dev/null
+++ b/data/referenceable_fields/3.12.json
@@ -0,0 +1,403 @@
+{
+  "acme": [
+    "config.account_email",
+    "config.eab_kid",
+    "config.eab_hmac_key",
+    "config.storage_config.redis.username",
+    "config.storage_config.redis.password",
+    "config.storage_config.consul.token",
+    "config.storage_config.vault.token"
+  ],
+  "ai-aws-guardrails": [
+    "config.aws_access_key_id",
+    "config.aws_secret_access_key"
+  ],
+  "ai-azure-content-safety": [
+    "config.content_safety_url",
+    "config.content_safety_key"
+  ],
+  "ai-llm-as-judge": [
+    "config.llm.auth.header_name",
+    "config.llm.auth.header_value",
+    "config.llm.auth.param_name",
+    "config.llm.auth.param_value",
+    "config.llm.auth.azure_client_id",
+    "config.llm.auth.azure_client_secret",
+    "config.llm.auth.azure_tenant_id",
+    "config.llm.auth.gcp_service_account_json",
+    "config.llm.auth.aws_access_key_id",
+    "config.llm.auth.aws_secret_access_key"
+  ],
+  "ai-proxy": [
+    "config.auth.header_name",
+    "config.auth.header_value",
+    "config.auth.param_name",
+    "config.auth.param_value",
+    "config.auth.azure_client_id",
+    "config.auth.azure_client_secret",
+    "config.auth.azure_tenant_id",
+    "config.auth.gcp_service_account_json",
+    "config.auth.aws_access_key_id",
+    "config.auth.aws_secret_access_key"
+  ],
+  "ai-proxy-advanced": [
+    "config.embeddings.auth.header_name",
+    "config.embeddings.auth.header_value",
+    "config.embeddings.auth.param_name",
+    "config.embeddings.auth.param_value",
+    "config.embeddings.auth.azure_client_id",
+    "config.embeddings.auth.azure_client_secret",
+    "config.embeddings.auth.azure_tenant_id",
+    "config.embeddings.auth.gcp_service_account_json",
+    "config.embeddings.auth.aws_access_key_id",
+    "config.embeddings.auth.aws_secret_access_key",
+    "config.vectordb.redis.username",
+    "config.vectordb.redis.password",
+    "config.vectordb.redis.sentinel_username",
+    "config.vectordb.redis.sentinel_password",
+    "config.vectordb.pgvector.user",
+    "config.vectordb.pgvector.password",
+    "config.targets.auth.header_name",
+    "config.targets.auth.header_value",
+    "config.targets.auth.param_name",
+    "config.targets.auth.param_value",
+    "config.targets.auth.azure_client_id",
+    "config.targets.auth.azure_client_secret",
+    "config.targets.auth.azure_tenant_id",
+    "config.targets.auth.gcp_service_account_json",
+    "config.targets.auth.aws_access_key_id",
+    "config.targets.auth.aws_secret_access_key"
+  ],
+  "ai-rag-injector": [
+    "config.embeddings.auth.header_name",
+    "config.embeddings.auth.header_value",
+    "config.embeddings.auth.param_name",
+    "config.embeddings.auth.param_value",
+    "config.embeddings.auth.azure_client_id",
+    "config.embeddings.auth.azure_client_secret",
+    "config.embeddings.auth.azure_tenant_id",
+    "config.embeddings.auth.gcp_service_account_json",
+    "config.embeddings.auth.aws_access_key_id",
+    "config.embeddings.auth.aws_secret_access_key",
+    "config.vectordb.redis.username",
+    "config.vectordb.redis.password",
+    "config.vectordb.redis.sentinel_username",
+    "config.vectordb.redis.sentinel_password",
+    "config.vectordb.pgvector.user",
+    "config.vectordb.pgvector.password"
+  ],
+  "ai-rate-limiting-advanced": [
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password"
+  ],
+  "ai-request-transformer": [
+    "config.llm.auth.header_name",
+    "config.llm.auth.header_value",
+    "config.llm.auth.param_name",
+    "config.llm.auth.param_value",
+    "config.llm.auth.azure_client_id",
+    "config.llm.auth.azure_client_secret",
+    "config.llm.auth.azure_tenant_id",
+    "config.llm.auth.gcp_service_account_json",
+    "config.llm.auth.aws_access_key_id",
+    "config.llm.auth.aws_secret_access_key"
+  ],
+  "ai-response-transformer": [
+    "config.llm.auth.header_name",
+    "config.llm.auth.header_value",
+    "config.llm.auth.param_name",
+    "config.llm.auth.param_value",
+    "config.llm.auth.azure_client_id",
+    "config.llm.auth.azure_client_secret",
+    "config.llm.auth.azure_tenant_id",
+    "config.llm.auth.gcp_service_account_json",
+    "config.llm.auth.aws_access_key_id",
+    "config.llm.auth.aws_secret_access_key"
+  ],
+  "ai-semantic-cache": [
+    "config.embeddings.auth.header_name",
+    "config.embeddings.auth.header_value",
+    "config.embeddings.auth.param_name",
+    "config.embeddings.auth.param_value",
+    "config.embeddings.auth.azure_client_id",
+    "config.embeddings.auth.azure_client_secret",
+    "config.embeddings.auth.azure_tenant_id",
+    "config.embeddings.auth.gcp_service_account_json",
+    "config.embeddings.auth.aws_access_key_id",
+    "config.embeddings.auth.aws_secret_access_key",
+    "config.vectordb.redis.username",
+    "config.vectordb.redis.password",
+    "config.vectordb.redis.sentinel_username",
+    "config.vectordb.redis.sentinel_password",
+    "config.vectordb.pgvector.user",
+    "config.vectordb.pgvector.password"
+  ],
+  "ai-semantic-prompt-guard": [
+    "config.embeddings.auth.header_name",
+    "config.embeddings.auth.header_value",
+    "config.embeddings.auth.param_name",
+    "config.embeddings.auth.param_value",
+    "config.embeddings.auth.azure_client_id",
+    "config.embeddings.auth.azure_client_secret",
+    "config.embeddings.auth.azure_tenant_id",
+    "config.embeddings.auth.gcp_service_account_json",
+    "config.embeddings.auth.aws_access_key_id",
+    "config.embeddings.auth.aws_secret_access_key",
+    "config.vectordb.redis.username",
+    "config.vectordb.redis.password",
+    "config.vectordb.redis.sentinel_username",
+    "config.vectordb.redis.sentinel_password",
+    "config.vectordb.pgvector.user",
+    "config.vectordb.pgvector.password"
+  ],
+  "aws-lambda": [
+    "config.aws_key",
+    "config.aws_secret",
+    "config.aws_assume_role_arn"
+  ],
+  "azure-functions": [
+    "config.apikey",
+    "config.clientid"
+  ],
+  "confluent": [
+    "config.schema_registry.confluent.authentication.basic.username",
+    "config.schema_registry.confluent.authentication.basic.password",
+    "config.cluster_api_key",
+    "config.cluster_api_secret",
+    "config.confluent_cloud_api_key",
+    "config.confluent_cloud_api_secret"
+  ],
+  "confluent-consume": [
+    "config.topics.schema_registry.confluent.authentication.basic.username",
+    "config.topics.schema_registry.confluent.authentication.basic.password",
+    "config.schema_registry.confluent.authentication.basic.username",
+    "config.schema_registry.confluent.authentication.basic.password",
+    "config.cluster_api_key",
+    "config.cluster_api_secret",
+    "config.confluent_cloud_api_key",
+    "config.confluent_cloud_api_secret"
+  ],
+  "datadog": [
+    "config.host"
+  ],
+  "datakit": [
+    "config.resources.vault"
+  ],
+  "forward-proxy": [
+    "config.auth_username",
+    "config.auth_password"
+  ],
+  "graphql-proxy-cache-advanced": [
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password"
+  ],
+  "graphql-rate-limiting-advanced": [
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password"
+  ],
+  "http-log": [
+    "config.http_endpoint",
+    "config.headers"
+  ],
+  "jwt-signer": [
+    "config.access_token_keyset_client_username",
+    "config.access_token_keyset_client_password",
+    "config.access_token_jwks_uri_client_username",
+    "config.access_token_jwks_uri_client_password",
+    "config.channel_token_keyset_client_username",
+    "config.channel_token_keyset_client_password",
+    "config.channel_token_jwks_uri_client_username",
+    "config.channel_token_jwks_uri_client_password"
+  ],
+  "kafka-consume": [
+    "config.topics.schema_registry.confluent.authentication.basic.username",
+    "config.topics.schema_registry.confluent.authentication.basic.password",
+    "config.schema_registry.confluent.authentication.basic.username",
+    "config.schema_registry.confluent.authentication.basic.password",
+    "config.authentication.user",
+    "config.authentication.password"
+  ],
+  "kafka-log": [
+    "config.authentication.user",
+    "config.authentication.password",
+    "config.schema_registry.confluent.authentication.basic.username",
+    "config.schema_registry.confluent.authentication.basic.password"
+  ],
+  "kafka-upstream": [
+    "config.schema_registry.confluent.authentication.basic.username",
+    "config.schema_registry.confluent.authentication.basic.password",
+    "config.authentication.user",
+    "config.authentication.password"
+  ],
+  "konnect-application-auth": [
+    "config.v2_strategies.openid_connect.config.client_id",
+    "config.v2_strategies.openid_connect.config.client_secret",
+    "config.v2_strategies.openid_connect.config.client_jwk.k",
+    "config.v2_strategies.openid_connect.config.client_jwk.d",
+    "config.v2_strategies.openid_connect.config.client_jwk.p",
+    "config.v2_strategies.openid_connect.config.client_jwk.q",
+    "config.v2_strategies.openid_connect.config.client_jwk.dp",
+    "config.v2_strategies.openid_connect.config.client_jwk.dq",
+    "config.v2_strategies.openid_connect.config.client_jwk.qi",
+    "config.v2_strategies.openid_connect.config.client_jwk.oth",
+    "config.v2_strategies.openid_connect.config.client_jwk.r",
+    "config.v2_strategies.openid_connect.config.client_jwk.t",
+    "config.v2_strategies.openid_connect.config.login_redirect_uri",
+    "config.v2_strategies.openid_connect.config.logout_redirect_uri",
+    "config.v2_strategies.openid_connect.config.scopes",
+    "config.v2_strategies.openid_connect.config.introspection_headers_values",
+    "config.v2_strategies.openid_connect.config.session_secret",
+    "config.v2_strategies.openid_connect.config.redis.username",
+    "config.v2_strategies.openid_connect.config.redis.password",
+    "config.v2_strategies.openid_connect.config.redis.sentinel_username",
+    "config.v2_strategies.openid_connect.config.redis.sentinel_password",
+    "config.v2_strategies.openid_connect.config.http_proxy_authorization",
+    "config.v2_strategies.openid_connect.config.https_proxy_authorization",
+    "config.v2_strategies.openid_connect.config.cluster_cache_redis.username",
+    "config.v2_strategies.openid_connect.config.cluster_cache_redis.password",
+    "config.v2_strategies.openid_connect.config.cluster_cache_redis.sentinel_username",
+    "config.v2_strategies.openid_connect.config.cluster_cache_redis.sentinel_password"
+  ],
+  "ldap-auth-advanced": [
+    "config.ldap_password",
+    "config.bind_dn"
+  ],
+  "loggly": [
+    "config.key"
+  ],
+  "oauth2-introspection": [
+    "config.authorization_value"
+  ],
+  "openid-connect": [
+    "config.client_id",
+    "config.client_secret",
+    "config.client_jwk.k",
+    "config.client_jwk.d",
+    "config.client_jwk.p",
+    "config.client_jwk.q",
+    "config.client_jwk.dp",
+    "config.client_jwk.dq",
+    "config.client_jwk.qi",
+    "config.client_jwk.oth",
+    "config.client_jwk.r",
+    "config.client_jwk.t",
+    "config.login_redirect_uri",
+    "config.logout_redirect_uri",
+    "config.scopes",
+    "config.introspection_headers_values",
+    "config.session_secret",
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password",
+    "config.http_proxy_authorization",
+    "config.https_proxy_authorization",
+    "config.cluster_cache_redis.username",
+    "config.cluster_cache_redis.password",
+    "config.cluster_cache_redis.sentinel_username",
+    "config.cluster_cache_redis.sentinel_password"
+  ],
+  "opentelemetry": [
+    "config.traces_endpoint",
+    "config.logs_endpoint",
+    "config.headers"
+  ],
+  "proxy-cache-advanced": [
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password"
+  ],
+  "rate-limiting": [
+    "config.redis.username",
+    "config.redis.password"
+  ],
+  "rate-limiting-advanced": [
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password"
+  ],
+  "request-callout": [
+    "config.callouts.request.url",
+    "config.callouts.request.http_opts.proxy.auth_username",
+    "config.callouts.request.http_opts.proxy.auth_password",
+    "config.callouts.request.query.custom",
+    "config.callouts.request.headers.custom",
+    "config.callouts.request.body.custom",
+    "config.cache.redis.username",
+    "config.cache.redis.password",
+    "config.cache.redis.sentinel_username",
+    "config.cache.redis.sentinel_password",
+    "config.upstream.query.custom",
+    "config.upstream.headers.custom",
+    "config.upstream.body.custom"
+  ],
+  "request-transformer-advanced": [
+    "config.rename.body",
+    "config.rename.headers",
+    "config.rename.querystring",
+    "config.replace.body",
+    "config.replace.headers",
+    "config.replace.querystring",
+    "config.add.body",
+    "config.add.headers",
+    "config.add.querystring",
+    "config.append.body",
+    "config.append.headers",
+    "config.append.querystring"
+  ],
+  "response-ratelimiting": [
+    "config.redis.username",
+    "config.redis.password"
+  ],
+  "saml": [
+    "config.idp_certificate",
+    "config.response_encryption_key",
+    "config.request_signing_key",
+    "config.request_signing_certificate",
+    "config.session_secret",
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password"
+  ],
+  "service-protection": [
+    "config.redis.username",
+    "config.redis.password",
+    "config.redis.sentinel_username",
+    "config.redis.sentinel_password"
+  ],
+  "session": [
+    "config.secret"
+  ],
+  "solace-upstream": [
+    "config.session.host",
+    "config.session.authentication.username",
+    "config.session.authentication.password",
+    "config.session.authentication.access_token",
+    "config.session.authentication.id_token",
+    "config.session.properties"
+  ],
+  "standard-webhooks": [
+    "config.secret_v1"
+  ],
+  "upstream-oauth": [
+    "config.oauth.token_headers",
+    "config.oauth.token_post_args",
+    "config.oauth.client_id",
+    "config.oauth.client_secret",
+    "config.oauth.username",
+    "config.oauth.password",
+    "config.cache.redis.username",
+    "config.cache.redis.password",
+    "config.cache.redis.sentinel_username",
+    "config.cache.redis.sentinel_password"
+  ]
+}
\ No newline at end of file
diff --git a/json_schemas/acme/3.12.json b/json_schemas/acme/3.12.json
index 3e259c34..a71bf8e6 100644
--- a/json_schemas/acme/3.12.json
+++ b/json_schemas/acme/3.12.json
@@ -181,7 +181,7 @@
                   "type": "string"
                 },
                 "password": {
-                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "minLength": 0,
                   "type": "string"
                 },
diff --git a/json_schemas/ai-azure-content-safety/3.12.json b/json_schemas/ai-azure-content-safety/3.12.json
index 78bd41e2..e4008eff 100644
--- a/json_schemas/ai-azure-content-safety/3.12.json
+++ b/json_schemas/ai-azure-content-safety/3.12.json
@@ -53,7 +53,7 @@
           "type": "array"
         },
         "content_safety_key": {
-          "description": "If `azure_use_managed_identity` is true, set the API key to call Content Safety.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "If `azure_use_managed_identity` is true, set the API key to call Content Safety.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "content_safety_url": {
diff --git a/json_schemas/ai-llm-as-judge/3.12.json b/json_schemas/ai-llm-as-judge/3.12.json
new file mode 100644
index 00000000..37dc3577
--- /dev/null
+++ b/json_schemas/ai-llm-as-judge/3.12.json
@@ -0,0 +1,455 @@
+{
+  "properties": {
+    "config": {
+      "properties": {
+        "http_proxy_host": {
+          "description": "A string representing a host name, such as example.com.",
+          "type": "string"
+        },
+        "http_proxy_port": {
+          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+          "maximum": 65535,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "http_timeout": {
+          "default": 60000,
+          "description": "Timeout in milliseconds for the AI upstream service.",
+          "type": "integer"
+        },
+        "https_proxy_host": {
+          "description": "A string representing a host name, such as example.com.",
+          "type": "string"
+        },
+        "https_proxy_port": {
+          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+          "maximum": 65535,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "https_verify": {
+          "default": true,
+          "description": "Verify the TLS certificate of the AI upstream service.",
+          "type": "boolean"
+        },
+        "ignore_assistant_prompts": {
+          "default": true,
+          "description": "Ignore and discard any assistant prompts when evaluating the request",
+          "type": "boolean"
+        },
+        "ignore_system_prompts": {
+          "default": true,
+          "description": "Ignore and discard any system prompts when evaluating the request",
+          "type": "boolean"
+        },
+        "ignore_tool_prompts": {
+          "default": true,
+          "description": "Ignore and discard any tool prompts when evaluating the request",
+          "type": "boolean"
+        },
+        "llm": {
+          "properties": {
+            "auth": {
+              "properties": {
+                "allow_override": {
+                  "default": false,
+                  "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                  "type": "boolean"
+                },
+                "aws_access_key_id": {
+                  "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "aws_secret_access_key": {
+                  "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "azure_client_id": {
+                  "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "azure_client_secret": {
+                  "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "azure_tenant_id": {
+                  "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "azure_use_managed_identity": {
+                  "default": false,
+                  "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                  "type": "boolean"
+                },
+                "gcp_service_account_json": {
+                  "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "gcp_use_service_account": {
+                  "default": false,
+                  "description": "Use service account auth for GCP-based providers and models.",
+                  "type": "boolean"
+                },
+                "header_name": {
+                  "description": "If AI model requires authentication via Authorization or API key header, specify its name here.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "header_value": {
+                  "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "param_location": {
+                  "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                  "enum": [
+                    "body",
+                    "query"
+                  ],
+                  "type": "string"
+                },
+                "param_name": {
+                  "description": "If AI model requires authentication via query parameter, specify its name here.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                },
+                "param_value": {
+                  "description": "Specify the full parameter value for 'param_name'.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                  "type": "string"
+                }
+              },
+              "required": [],
+              "type": "object"
+            },
+            "logging": {
+              "properties": {
+                "log_payloads": {
+                  "default": false,
+                  "description": "If enabled, will log the request and response body into the Kong log plugin(s) output.",
+                  "type": "boolean"
+                },
+                "log_statistics": {
+                  "default": false,
+                  "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log plugin(s) output.",
+                  "type": "boolean"
+                }
+              },
+              "required": [],
+              "type": "object"
+            },
+            "model": {
+              "properties": {
+                "name": {
+                  "description": "Model name to execute.",
+                  "type": "string"
+                },
+                "options": {
+                  "description": "Key/value settings for the model",
+                  "properties": {
+                    "anthropic_version": {
+                      "description": "Defines the schema/API version, if using Anthropic provider.",
+                      "type": "string"
+                    },
+                    "azure_api_version": {
+                      "default": "2023-05-15",
+                      "description": "'api-version' for Azure OpenAI instances.",
+                      "type": "string"
+                    },
+                    "azure_deployment_id": {
+                      "description": "Deployment ID for Azure OpenAI instances.",
+                      "type": "string"
+                    },
+                    "azure_instance": {
+                      "description": "Instance name for Azure OpenAI hosted models.",
+                      "type": "string"
+                    },
+                    "bedrock": {
+                      "properties": {
+                        "aws_assume_role_arn": {
+                          "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                          "type": "string"
+                        },
+                        "aws_region": {
+                          "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                          "type": "string"
+                        },
+                        "aws_role_session_name": {
+                          "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                          "type": "string"
+                        },
+                        "aws_sts_endpoint_url": {
+                          "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                          "type": "string"
+                        },
+                        "embeddings_normalize": {
+                          "default": false,
+                          "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                          "type": "boolean"
+                        },
+                        "performance_config_latency": {
+                          "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                          "type": "string"
+                        }
+                      },
+                      "required": [],
+                      "type": "object"
+                    },
+                    "cohere": {
+                      "properties": {
+                        "embedding_input_type": {
+                          "default": "classification",
+                          "description": "The purpose of the input text to calculate embedding vectors.",
+                          "enum": [
+                            "classification",
+                            "clustering",
+                            "image",
+                            "search_document",
+                            "search_query"
+                          ],
+                          "type": "string"
+                        },
+                        "wait_for_model": {
+                          "description": "Wait for the model if it is not ready",
+                          "type": "boolean"
+                        }
+                      },
+                      "required": [],
+                      "type": "object"
+                    },
+                    "embeddings_dimensions": {
+                      "description": "If using embeddings models, set the number of dimensions to generate.",
+                      "minimum": 0,
+                      "type": "integer"
+                    },
+                    "gemini": {
+                      "properties": {
+                        "api_endpoint": {
+                          "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                          "type": "string"
+                        },
+                        "location_id": {
+                          "description": "If running Gemini on Vertex, specify the location ID.",
+                          "type": "string"
+                        },
+                        "project_id": {
+                          "description": "If running Gemini on Vertex, specify the project ID.",
+                          "type": "string"
+                        }
+                      },
+                      "required": [],
+                      "type": "object"
+                    },
+                    "huggingface": {
+                      "properties": {
+                        "use_cache": {
+                          "description": "Use the cache layer on the inference API",
+                          "type": "boolean"
+                        },
+                        "wait_for_model": {
+                          "description": "Wait for the model if it is not ready",
+                          "type": "boolean"
+                        }
+                      },
+                      "required": [],
+                      "type": "object"
+                    },
+                    "input_cost": {
+                      "description": "Defines the cost per 1M tokens in your prompt.",
+                      "minimum": 0,
+                      "type": "number"
+                    },
+                    "llama2_format": {
+                      "description": "If using llama2 provider, select the upstream message format.",
+                      "enum": [
+                        "ollama",
+                        "openai",
+                        "raw"
+                      ],
+                      "type": "string"
+                    },
+                    "max_tokens": {
+                      "description": "Defines the max_tokens, if using chat or completion models.",
+                      "type": "integer"
+                    },
+                    "mistral_format": {
+                      "description": "If using mistral provider, select the upstream message format.",
+                      "enum": [
+                        "ollama",
+                        "openai"
+                      ],
+                      "type": "string"
+                    },
+                    "output_cost": {
+                      "description": "Defines the cost per 1M tokens in the output of the AI.",
+                      "minimum": 0,
+                      "type": "number"
+                    },
+                    "temperature": {
+                      "description": "Defines the matching temperature, if using chat or completion models.",
+                      "maximum": 5,
+                      "minimum": 0,
+                      "type": "number"
+                    },
+                    "top_k": {
+                      "description": "Defines the top-k most likely tokens, if supported.",
+                      "maximum": 500,
+                      "minimum": 0,
+                      "type": "integer"
+                    },
+                    "top_p": {
+                      "description": "Defines the top-p probability mass, if supported.",
+                      "maximum": 1,
+                      "minimum": 0,
+                      "type": "number"
+                    },
+                    "upstream_path": {
+                      "description": "Manually specify or override the AI operation path, used when e.g. using the 'preserve' route_type.",
+                      "type": "string"
+                    },
+                    "upstream_url": {
+                      "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [],
+                  "type": "object"
+                },
+                "provider": {
+                  "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats.",
+                  "enum": [
+                    "anthropic",
+                    "azure",
+                    "bedrock",
+                    "cohere",
+                    "gemini",
+                    "huggingface",
+                    "llama2",
+                    "mistral",
+                    "openai"
+                  ],
+                  "type": "string"
+                }
+              },
+              "required": [
+                "provider"
+              ],
+              "type": "object"
+            },
+            "route_type": {
+              "description": "The model's operation implementation, for this provider. ",
+              "enum": [
+                "audio/v1/audio/speech",
+                "audio/v1/audio/transcriptions",
+                "audio/v1/audio/translations",
+                "image/v1/images/edits",
+                "image/v1/images/generations",
+                "llm/v1/assistants",
+                "llm/v1/batches",
+                "llm/v1/chat",
+                "llm/v1/completions",
+                "llm/v1/embeddings",
+                "llm/v1/files",
+                "llm/v1/responses",
+                "preserve",
+                "realtime/v1/realtime"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "model",
+            "route_type"
+          ],
+          "type": "object"
+        },
+        "message_countback": {
+          "default": 1,
+          "description": "Number of messages in the chat history to use for evaluating the request",
+          "maximum": 1000,
+          "minimum": 1,
+          "type": "number"
+        },
+        "prompt": {
+          "default": "You are a strict evaluator. You will be given a prompt and a response. Your task is to judge whether the response is correct or incorrect. You must assign a score between 1 and 100, where: 100 represents a completely correct and ideal response, 1 represents a completely incorrect or irrelevant response. Your score must be a single number only — no text, labels, or explanations. Use the full range of values (e.g., 13, 47, 86), not just round numbers like 10, 50, or 100. Be accurate and consistent, as this score will be used by another model for learning and evaluation.",
+          "description": "Use this prompt to tune the LLM system/assistant message for the llm as a judge prompt.",
+          "type": "string"
+        },
+        "sampling_rate": {
+          "default": 1,
+          "description": "Judging request sampling rate for configuring the probability-based sampler.",
+          "maximum": 1,
+          "minimum": 0,
+          "type": "number"
+        }
+      },
+      "required": [
+        "llm"
+      ],
+      "type": "object"
+    },
+    "consumer": {
+      "additionalProperties": false,
+      "description": "If set, the plugin will activate only for requests where the specified has been authenticated. (Note that some plugins can not be restricted to consumers this way.). Leave unset for the plugin to activate regardless of the authenticated Consumer.",
+      "properties": {
+        "id": {
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    },
+    "consumer_group": {
+      "additionalProperties": false,
+      "description": "If set, the plugin will activate only for requests where the specified consumer group has been authenticated. (Note that some plugins can not be restricted to consumers groups this way.). Leave unset for the plugin to activate regardless of the authenticated Consumer Groups",
+      "properties": {
+        "id": {
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    },
+    "protocols": {
+      "default": [
+        "grpc",
+        "grpcs",
+        "http",
+        "https"
+      ],
+      "description": "A set of strings representing HTTP protocols.",
+      "items": {
+        "enum": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "required": [],
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "route": {
+      "additionalProperties": false,
+      "description": "If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.",
+      "properties": {
+        "id": {
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    },
+    "service": {
+      "additionalProperties": false,
+      "description": "If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.",
+      "properties": {
+        "id": {
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    }
+  },
+  "required": [
+    "config"
+  ]
+}
\ No newline at end of file
diff --git a/json_schemas/ai-proxy-advanced/3.12.json b/json_schemas/ai-proxy-advanced/3.12.json
index 6b989d36..043610c0 100644
--- a/json_schemas/ai-proxy-advanced/3.12.json
+++ b/json_schemas/ai-proxy-advanced/3.12.json
@@ -88,6 +88,7 @@
               "enum": [
                 "completion-tokens",
                 "cost",
+                "llm-accuracy",
                 "prompt-tokens",
                 "total-tokens"
               ],
diff --git a/json_schemas/ai-rate-limiting-advanced/3.12.json b/json_schemas/ai-rate-limiting-advanced/3.12.json
index a186af04..4038947b 100644
--- a/json_schemas/ai-rate-limiting-advanced/3.12.json
+++ b/json_schemas/ai-rate-limiting-advanced/3.12.json
@@ -183,7 +183,7 @@
               "type": "integer"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "port": {
@@ -235,7 +235,7 @@
               "type": "array"
             },
             "sentinel_password": {
-              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "sentinel_role": {
diff --git a/json_schemas/ai-sanitizer/3.12.json b/json_schemas/ai-sanitizer/3.12.json
index 173cfde1..5c620c27 100644
--- a/json_schemas/ai-sanitizer/3.12.json
+++ b/json_schemas/ai-sanitizer/3.12.json
@@ -83,7 +83,7 @@
         },
         "recover_redacted": {
           "default": true,
-          "description": "Whether to recover redacted data",
+          "description": "Whether to recover redacted data. This doesn't apply to the redacted output.",
           "type": "boolean"
         },
         "redact_type": {
@@ -95,6 +95,16 @@
           ],
           "type": "string"
         },
+        "sanitization_mode": {
+          "default": "INPUT",
+          "description": "The sanitization mode to use for the request",
+          "enum": [
+            "BOTH",
+            "INPUT",
+            "OUTPUT"
+          ],
+          "type": "string"
+        },
         "scheme": {
           "default": "http",
           "description": "The protocol can be http and https",
@@ -102,7 +112,7 @@
         },
         "stop_on_error": {
           "default": true,
-          "description": "Stop processing if an error occurs",
+          "description": "Stop processing if an error occurs.",
           "type": "boolean"
         },
         "timeout": {
diff --git a/json_schemas/ai-semantic-cache/3.12.json b/json_schemas/ai-semantic-cache/3.12.json
index a63afc95..6933d799 100644
--- a/json_schemas/ai-semantic-cache/3.12.json
+++ b/json_schemas/ai-semantic-cache/3.12.json
@@ -281,7 +281,7 @@
                   "type": "string"
                 },
                 "password": {
-                  "description": "the password of the pgvector database\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "the password of the pgvector database\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "port": {
@@ -402,7 +402,7 @@
                   "type": "integer"
                 },
                 "password": {
-                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "port": {
@@ -454,7 +454,7 @@
                   "type": "array"
                 },
                 "sentinel_password": {
-                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "sentinel_role": {
diff --git a/json_schemas/ai-semantic-prompt-guard/3.12.json b/json_schemas/ai-semantic-prompt-guard/3.12.json
index 9df98077..f4bf551a 100644
--- a/json_schemas/ai-semantic-prompt-guard/3.12.json
+++ b/json_schemas/ai-semantic-prompt-guard/3.12.json
@@ -306,7 +306,7 @@
                   "type": "string"
                 },
                 "password": {
-                  "description": "the password of the pgvector database\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "the password of the pgvector database\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "port": {
@@ -427,7 +427,7 @@
                   "type": "integer"
                 },
                 "password": {
-                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "port": {
@@ -479,7 +479,7 @@
                   "type": "array"
                 },
                 "sentinel_password": {
-                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "sentinel_role": {
diff --git a/json_schemas/azure-functions/3.12.json b/json_schemas/azure-functions/3.12.json
index cf086bb2..f5f57656 100644
--- a/json_schemas/azure-functions/3.12.json
+++ b/json_schemas/azure-functions/3.12.json
@@ -3,7 +3,7 @@
     "config": {
       "properties": {
         "apikey": {
-          "description": "The apikey to access the Azure resources. If provided, it is injected as the `x-functions-key` header.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+          "description": "The apikey to access the Azure resources. If provided, it is injected as the `x-functions-key` header.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
           "type": "string"
         },
         "appname": {
@@ -11,7 +11,7 @@
           "type": "string"
         },
         "clientid": {
-          "description": "The `clientid` to access the Azure resources. If provided, it is injected as the `x-functions-clientid` header.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+          "description": "The `clientid` to access the Azure resources. If provided, it is injected as the `x-functions-clientid` header.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
           "type": "string"
         },
         "functionname": {
diff --git a/json_schemas/confluent-consume/3.12.json b/json_schemas/confluent-consume/3.12.json
index 5cb0a0a5..24da0bf9 100644
--- a/json_schemas/confluent-consume/3.12.json
+++ b/json_schemas/confluent-consume/3.12.json
@@ -35,11 +35,11 @@
           "type": "array"
         },
         "cluster_api_key": {
-          "description": "Username/Apikey for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "Username/Apikey for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "cluster_api_secret": {
-          "description": "Password/ApiSecret for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "Password/ApiSecret for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "cluster_name": {
@@ -56,11 +56,11 @@
           "type": "string"
         },
         "confluent_cloud_api_key": {
-          "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "confluent_cloud_api_secret": {
-          "description": "The corresponding secret for the Confluent Cloud API key.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "The corresponding secret for the Confluent Cloud API key.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "keepalive": {
@@ -100,11 +100,11 @@
                     "basic": {
                       "properties": {
                         "password": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         },
                         "username": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         }
                       },
@@ -174,11 +174,11 @@
                           "basic": {
                             "properties": {
                               "password": {
-                                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                                 "type": "string"
                               },
                               "username": {
-                                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                                 "type": "string"
                               }
                             },
diff --git a/json_schemas/confluent/3.12.json b/json_schemas/confluent/3.12.json
index 1f00fb24..17e34ed9 100644
--- a/json_schemas/confluent/3.12.json
+++ b/json_schemas/confluent/3.12.json
@@ -34,11 +34,11 @@
           "type": "array"
         },
         "cluster_api_key": {
-          "description": "Username/Apikey for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "Username/Apikey for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "cluster_api_secret": {
-          "description": "Password/ApiSecret for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "Password/ApiSecret for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "cluster_name": {
@@ -46,11 +46,11 @@
           "type": "string"
         },
         "confluent_cloud_api_key": {
-          "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "confluent_cloud_api_secret": {
-          "description": "The corresponding secret for the Confluent Cloud API key.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "The corresponding secret for the Confluent Cloud API key.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "forward_body": {
@@ -154,11 +154,11 @@
                     "basic": {
                       "properties": {
                         "password": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         },
                         "username": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         }
                       },
diff --git a/json_schemas/degraphql/3.12.json b/json_schemas/degraphql/3.12.json
index 305dfff1..d4deea3a 100644
--- a/json_schemas/degraphql/3.12.json
+++ b/json_schemas/degraphql/3.12.json
@@ -4,7 +4,7 @@
       "properties": {
         "graphql_server_path": {
           "default": "/graphql",
-          "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).",
+          "description": "The GraphQL endpoint serve path",
           "type": "string"
         }
       },
diff --git a/json_schemas/graphql-proxy-cache-advanced/3.12.json b/json_schemas/graphql-proxy-cache-advanced/3.12.json
index 51ffa9b4..1910045c 100644
--- a/json_schemas/graphql-proxy-cache-advanced/3.12.json
+++ b/json_schemas/graphql-proxy-cache-advanced/3.12.json
@@ -90,7 +90,7 @@
               "type": "integer"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "port": {
@@ -142,7 +142,7 @@
               "type": "array"
             },
             "sentinel_password": {
-              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "sentinel_role": {
diff --git a/json_schemas/graphql-rate-limiting-advanced/3.12.json b/json_schemas/graphql-rate-limiting-advanced/3.12.json
index 02e2faed..ace251c5 100644
--- a/json_schemas/graphql-rate-limiting-advanced/3.12.json
+++ b/json_schemas/graphql-rate-limiting-advanced/3.12.json
@@ -119,7 +119,7 @@
               "type": "integer"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "port": {
@@ -171,7 +171,7 @@
               "type": "array"
             },
             "sentinel_password": {
-              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "sentinel_role": {
diff --git a/json_schemas/http-log/3.12.json b/json_schemas/http-log/3.12.json
index fdc45864..9c897a81 100644
--- a/json_schemas/http-log/3.12.json
+++ b/json_schemas/http-log/3.12.json
@@ -26,7 +26,7 @@
           "type": "object"
         },
         "http_endpoint": {
-          "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "keepalive": {
diff --git a/json_schemas/jwt-signer/3.12.json b/json_schemas/jwt-signer/3.12.json
index cfb49862..e2b97518 100644
--- a/json_schemas/jwt-signer/3.12.json
+++ b/json_schemas/jwt-signer/3.12.json
@@ -119,7 +119,7 @@
           "type": "string"
         },
         "access_token_jwks_uri_client_password": {
-          "description": "The client password that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_username`\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "The client password that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_username`\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "access_token_jwks_uri_client_username": {
@@ -141,7 +141,7 @@
           "type": "string"
         },
         "access_token_keyset_client_password": {
-          "description": "The client password that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_username`\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "The client password that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_username`\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "access_token_keyset_client_username": {
@@ -369,7 +369,7 @@
           "type": "string"
         },
         "channel_token_jwks_uri_client_password": {
-          "description": "The client password that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_username`\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "The client password that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_username`\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "channel_token_jwks_uri_client_username": {
@@ -391,7 +391,7 @@
           "type": "string"
         },
         "channel_token_keyset_client_password": {
-          "description": "The client password that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_username`\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "The client password that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_username`\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "channel_token_keyset_client_username": {
diff --git a/json_schemas/kafka-consume/3.12.json b/json_schemas/kafka-consume/3.12.json
index 11fdd8ae..febbbe06 100644
--- a/json_schemas/kafka-consume/3.12.json
+++ b/json_schemas/kafka-consume/3.12.json
@@ -110,11 +110,11 @@
                     "basic": {
                       "properties": {
                         "password": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         },
                         "username": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         }
                       },
@@ -194,11 +194,11 @@
                           "basic": {
                             "properties": {
                               "password": {
-                                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                                 "type": "string"
                               },
                               "username": {
-                                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                                 "type": "string"
                               }
                             },
@@ -308,17 +308,6 @@
       },
       "required": [],
       "type": "object"
-    },
-    "service": {
-      "additionalProperties": false,
-      "description": "If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.",
-      "properties": {
-        "id": {
-          "type": "string"
-        }
-      },
-      "required": [],
-      "type": "object"
     }
   },
   "required": [
diff --git a/json_schemas/kafka-log/3.12.json b/json_schemas/kafka-log/3.12.json
index e1121c3f..c9e666ae 100644
--- a/json_schemas/kafka-log/3.12.json
+++ b/json_schemas/kafka-log/3.12.json
@@ -14,7 +14,7 @@
               "type": "string"
             },
             "password": {
-              "description": "Password for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "strategy": {
@@ -29,7 +29,7 @@
               "type": "boolean"
             },
             "user": {
-              "description": "Username for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Username for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             }
           },
@@ -140,11 +140,11 @@
                     "basic": {
                       "properties": {
                         "password": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         },
                         "username": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         }
                       },
diff --git a/json_schemas/kafka-upstream/3.12.json b/json_schemas/kafka-upstream/3.12.json
index dcdff454..f3ce103c 100644
--- a/json_schemas/kafka-upstream/3.12.json
+++ b/json_schemas/kafka-upstream/3.12.json
@@ -22,7 +22,7 @@
               "type": "string"
             },
             "password": {
-              "description": "Password for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+              "description": "Password for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
               "type": "string"
             },
             "strategy": {
@@ -37,7 +37,7 @@
               "type": "boolean"
             },
             "user": {
-              "description": "Username for SASL authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+              "description": "Username for SASL authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
               "type": "string"
             }
           },
@@ -172,11 +172,11 @@
                     "basic": {
                       "properties": {
                         "password": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         },
                         "username": {
-                          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                           "type": "string"
                         }
                       },
diff --git a/json_schemas/konnect-application-auth/3.12.json b/json_schemas/konnect-application-auth/3.12.json
index 80e28e6c..1d70e29a 100644
--- a/json_schemas/konnect-application-auth/3.12.json
+++ b/json_schemas/konnect-application-auth/3.12.json
@@ -373,15 +373,15 @@
                               "type": "string"
                             },
                             "d": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "dp": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "dq": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "e": {
@@ -391,7 +391,7 @@
                               "type": "string"
                             },
                             "k": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "key_ops": {
@@ -411,27 +411,27 @@
                               "type": "string"
                             },
                             "oth": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "p": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "q": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "qi": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "r": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "t": {
-                              "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                              "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                               "type": "string"
                             },
                             "use": {
@@ -540,7 +540,7 @@
                             "type": "integer"
                           },
                           "password": {
-                            "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                            "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                             "type": "string"
                           },
                           "port": {
@@ -592,7 +592,7 @@
                             "type": "array"
                           },
                           "sentinel_password": {
-                            "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                            "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                             "type": "string"
                           },
                           "sentinel_role": {
@@ -1778,7 +1778,7 @@
                         "type": "number"
                       },
                       "session_secret": {
-                        "description": "The session secret.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                        "description": "The session secret.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                         "type": "string"
                       },
                       "session_storage": {
diff --git a/json_schemas/loggly/3.12.json b/json_schemas/loggly/3.12.json
index 85be5531..1817751b 100644
--- a/json_schemas/loggly/3.12.json
+++ b/json_schemas/loggly/3.12.json
@@ -27,7 +27,7 @@
           "type": "string"
         },
         "key": {
-          "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "log_level": {
diff --git a/json_schemas/oauth2-introspection/3.12.json b/json_schemas/oauth2-introspection/3.12.json
index a3100db7..2f7b7743 100644
--- a/json_schemas/oauth2-introspection/3.12.json
+++ b/json_schemas/oauth2-introspection/3.12.json
@@ -9,7 +9,7 @@
           "type": "string"
         },
         "authorization_value": {
-          "description": "The value to set as the `Authorization` header when querying the introspection endpoint. This depends on the OAuth 2.0 server, but usually is the `client_id` and `client_secret` as a Base64-encoded Basic Auth string (`Basic MG9hNWl...`).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+          "description": "The value to set as the `Authorization` header when querying the introspection endpoint. This depends on the OAuth 2.0 server, but usually is the `client_id` and `client_secret` as a Base64-encoded Basic Auth string (`Basic MG9hNWl...`).\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
           "type": "string"
         },
         "consumer_by": {
diff --git a/json_schemas/openid-connect/3.12.json b/json_schemas/openid-connect/3.12.json
index 0bda9092..1b097bac 100644
--- a/json_schemas/openid-connect/3.12.json
+++ b/json_schemas/openid-connect/3.12.json
@@ -302,15 +302,15 @@
                 "type": "string"
               },
               "d": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "dp": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "dq": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "e": {
@@ -320,7 +320,7 @@
                 "type": "string"
               },
               "k": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "key_ops": {
@@ -340,27 +340,27 @@
                 "type": "string"
               },
               "oth": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "p": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "q": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "qi": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "r": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "t": {
-                "description": "This field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                "description": "This field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                 "type": "string"
               },
               "use": {
@@ -469,7 +469,7 @@
               "type": "integer"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "port": {
@@ -521,7 +521,7 @@
               "type": "array"
             },
             "sentinel_password": {
-              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "sentinel_role": {
@@ -1707,7 +1707,7 @@
           "type": "number"
         },
         "session_secret": {
-          "description": "The session secret.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+          "description": "The session secret.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
           "type": "string"
         },
         "session_storage": {
diff --git a/json_schemas/proxy-cache-advanced/3.12.json b/json_schemas/proxy-cache-advanced/3.12.json
index 8bd5e5de..0e5683d2 100644
--- a/json_schemas/proxy-cache-advanced/3.12.json
+++ b/json_schemas/proxy-cache-advanced/3.12.json
@@ -112,7 +112,7 @@
               "type": "integer"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "port": {
@@ -164,7 +164,7 @@
               "type": "array"
             },
             "sentinel_password": {
-              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "sentinel_role": {
diff --git a/json_schemas/rate-limiting/3.12.json b/json_schemas/rate-limiting/3.12.json
index d6ae0321..7f349cef 100644
--- a/json_schemas/rate-limiting/3.12.json
+++ b/json_schemas/rate-limiting/3.12.json
@@ -89,7 +89,7 @@
               "type": "string"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "minLength": 0,
               "type": "string"
             },
diff --git a/json_schemas/request-callout/3.12.json b/json_schemas/request-callout/3.12.json
index 3a7b0d41..a7084510 100644
--- a/json_schemas/request-callout/3.12.json
+++ b/json_schemas/request-callout/3.12.json
@@ -88,7 +88,7 @@
                   "type": "integer"
                 },
                 "password": {
-                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "port": {
@@ -140,7 +140,7 @@
                   "type": "array"
                 },
                 "sentinel_password": {
-                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "sentinel_role": {
@@ -334,7 +334,7 @@
                         "description": "Proxy settings.",
                         "properties": {
                           "auth_password": {
-                            "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+                            "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
                             "type": "string"
                           },
                           "auth_username": {
diff --git a/json_schemas/response-ratelimiting/3.12.json b/json_schemas/response-ratelimiting/3.12.json
index cc9f59be..8469c086 100644
--- a/json_schemas/response-ratelimiting/3.12.json
+++ b/json_schemas/response-ratelimiting/3.12.json
@@ -61,7 +61,7 @@
               "type": "string"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "minLength": 0,
               "type": "string"
             },
diff --git a/json_schemas/service-protection/3.12.json b/json_schemas/service-protection/3.12.json
index e7d65997..6dce2f82 100644
--- a/json_schemas/service-protection/3.12.json
+++ b/json_schemas/service-protection/3.12.json
@@ -111,7 +111,7 @@
               "type": "integer"
             },
             "password": {
-              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "port": {
@@ -163,7 +163,7 @@
               "type": "array"
             },
             "sentinel_password": {
-              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+              "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
               "type": "string"
             },
             "sentinel_role": {
diff --git a/json_schemas/session/3.12.json b/json_schemas/session/3.12.json
index 64337fc3..868991c4 100644
--- a/json_schemas/session/3.12.json
+++ b/json_schemas/session/3.12.json
@@ -148,7 +148,7 @@
           "type": "number"
         },
         "secret": {
-          "default": "qIy2DUgDyM6HDlP9lMhdI8h1gmCQCLgBdb0RS0vxLGsp",
+          "default": "OHD3DR0DIXyHajNcGLzHZ4pXURqJk8EgPHGvhAarIuUv",
           "description": "The secret that is used in keyed HMAC generation.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
diff --git a/json_schemas/solace-upstream/3.12.json b/json_schemas/solace-upstream/3.12.json
index 44da5a7e..bbbbf7c3 100644
--- a/json_schemas/solace-upstream/3.12.json
+++ b/json_schemas/solace-upstream/3.12.json
@@ -125,21 +125,21 @@
               "description": "Session authentication related configuration.",
               "properties": {
                 "access_token": {
-                  "description": "The OAuth2 access token used with `OAUTH2` authentication scheme when connecting to an event broker.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "The OAuth2 access token used with `OAUTH2` authentication scheme when connecting to an event broker.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "access_token_header": {
                   "type": "string"
                 },
                 "id_token": {
-                  "description": "The OpenID Connect ID token used with `OAUTH2` authentication scheme when connecting to an event broker.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "The OpenID Connect ID token used with `OAUTH2` authentication scheme when connecting to an event broker.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "id_token_header": {
                   "type": "string"
                 },
                 "password": {
-                  "description": "The password used with `BASIC` authentication scheme when connecting to an event broker.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "The password used with `BASIC` authentication scheme when connecting to an event broker.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "scheme": {
diff --git a/json_schemas/standard-webhooks/3.12.json b/json_schemas/standard-webhooks/3.12.json
index cc63f652..c896800d 100644
--- a/json_schemas/standard-webhooks/3.12.json
+++ b/json_schemas/standard-webhooks/3.12.json
@@ -3,7 +3,7 @@
     "config": {
       "properties": {
         "secret_v1": {
-          "description": "Webhook secret\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+          "description": "Webhook secret\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
           "type": "string"
         },
         "tolerance_second": {
diff --git a/json_schemas/upstream-oauth/3.12.json b/json_schemas/upstream-oauth/3.12.json
index 0c39674a..db0dcf0d 100644
--- a/json_schemas/upstream-oauth/3.12.json
+++ b/json_schemas/upstream-oauth/3.12.json
@@ -143,7 +143,7 @@
                   "type": "integer"
                 },
                 "password": {
-                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "port": {
@@ -195,7 +195,7 @@
                   "type": "array"
                 },
                 "sentinel_password": {
-                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
+                  "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
                   "type": "string"
                 },
                 "sentinel_role": {
@@ -345,11 +345,11 @@
               "type": "array"
             },
             "client_id": {
-              "description": "The client ID for the application registration in the IdP.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+              "description": "The client ID for the application registration in the IdP.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
               "type": "string"
             },
             "client_secret": {
-              "description": "The client secret for the application registration in the IdP.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+              "description": "The client secret for the application registration in the IdP.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
               "type": "string"
             },
             "grant_type": {
@@ -362,7 +362,7 @@
               "type": "string"
             },
             "password": {
-              "description": "The password to use if `config.oauth.grant_type` is set to `password`.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+              "description": "The password to use if `config.oauth.grant_type` is set to `password`.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
               "type": "string"
             },
             "scopes": {
@@ -391,7 +391,7 @@
               "type": "object"
             },
             "username": {
-              "description": "The username to use if `config.oauth.grant_type` is set to `password`.\nThis field is [encrypted](/gateway/keyring/).\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).",
+              "description": "The username to use if `config.oauth.grant_type` is set to `password`.\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).\nThis field is [encrypted](/gateway/keyring/).",
               "type": "string"
             }
           },
diff --git a/json_schemas/upstream-timeout/3.12.json b/json_schemas/upstream-timeout/3.12.json
index b21059ae..598a0415 100644
--- a/json_schemas/upstream-timeout/3.12.json
+++ b/json_schemas/upstream-timeout/3.12.json
@@ -3,19 +3,19 @@
     "config": {
       "properties": {
         "connect_timeout": {
-          "description": "An integer representing a timeout in milliseconds. Must be between 1 and 2^31-2.",
+          "description": "The timeout in milliseconds for establishing a connection to the upstream server. Must be an integer between 1 and 2^31-2.",
           "maximum": 2147483646,
           "minimum": 0,
           "type": "integer"
         },
         "read_timeout": {
-          "description": "An integer representing a timeout in milliseconds. Must be between 1 and 2^31-2.",
+          "description": "The timeout in milliseconds between two successive read operations for transmitting a request to the upstream server. Must be an integer between 1 and 2^31-2.",
           "maximum": 2147483646,
           "minimum": 0,
           "type": "integer"
         },
         "send_timeout": {
-          "description": "An integer representing a timeout in milliseconds. Must be between 1 and 2^31-2.",
+          "description": "The timeout in milliseconds between two successive write operations for transmitting a request to the upstream server. Must be an integer between 1 and 2^31-2.",
           "maximum": 2147483646,
           "minimum": 0,
           "type": "integer"
diff --git a/schemas/acl/3.12.json b/schemas/acl/3.12.json
new file mode 100644
index 00000000..5445c997
--- /dev/null
+++ b/schemas/acl/3.12.json
@@ -0,0 +1,106 @@
+{
+  "entity_checks": [
+    {
+      "only_one_of": [
+        "config.allow",
+        "config.deny"
+      ]
+    },
+    {
+      "at_least_one_of": [
+        "config.allow",
+        "config.deny"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "allow": {
+              "description": "Arbitrary group names that are allowed to consume the service or route. One of `config.allow` or `config.deny` must be specified.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "deny": {
+              "description": "Arbitrary group names that are not allowed to consume the service or route. One of `config.allow` or `config.deny` must be specified.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "hide_groups_header": {
+              "description": "If enabled (`true`), prevents the `X-Consumer-Groups` header from being sent in the request to the upstream service.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "include_consumer_groups": {
+              "description": "If enabled (`true`), allows the consumer-groups to be used in the `allow|deny` fields",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "always_use_authenticated_groups": {
+              "description": "If enabled (`true`), the authenticated groups will always be used even when an authenticated consumer already exists. If the authenticated groups don't exist, it will fallback to use the groups associated with the consumer. By default the authenticated groups will only be used when there is no consumer or the consumer is anonymous.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/acme/3.12.json b/schemas/acme/3.12.json
new file mode 100644
index 00000000..60833a90
--- /dev/null
+++ b/schemas/acme/3.12.json
@@ -0,0 +1,626 @@
+{
+  "entity_checks": [
+    {
+      "conditional": {
+        "then_field": "config.tos_accepted",
+        "then_err": "terms of service must be accepted, see https://letsencrypt.org/repository/",
+        "then_match": {
+          "eq": true
+        },
+        "if_match": {
+          "one_of": [
+            "https://acme-v02.api.letsencrypt.org",
+            "https://acme-staging-v02.api.letsencrypt.org"
+          ]
+        },
+        "if_field": "config.api_uri"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.storage_config.redis.host",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.storage"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.storage_config.redis.port",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.storage"
+      }
+    },
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.storage"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "service": {
+        "eq": null,
+        "reference": "services",
+        "description": "A reference to the 'services' table with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "route": {
+        "eq": null,
+        "reference": "routes",
+        "description": "A reference to the 'routes' table with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "account_email": {
+              "description": "The account identifier. Can be reused in a different plugin instance.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "match": "%w*%p*@+%w*%.?%w*",
+              "required": true
+            }
+          },
+          {
+            "account_key": {
+              "description": "The private key associated with the account.",
+              "type": "record",
+              "fields": [
+                {
+                  "key_id": {
+                    "description": "The Key ID.",
+                    "type": "string",
+                    "required": true
+                  }
+                },
+                {
+                  "key_set": {
+                    "description": "The ID of the key set to associate the Key ID with.",
+                    "type": "string"
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "api_uri": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "type": "string",
+              "default": "https://acme-v02.api.letsencrypt.org/directory"
+            }
+          },
+          {
+            "tos_accepted": {
+              "description": "If you are using Let's Encrypt, you must set this to `true` to agree the terms of service.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "eab_kid": {
+              "description": "External account binding (EAB) key id. You usually don't need to set this unless it is explicitly required by the CA.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "eab_hmac_key": {
+              "description": "External account binding (EAB) base64-encoded URL string of the HMAC key. You usually don't need to set this unless it is explicitly required by the CA.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "cert_type": {
+              "description": "The certificate type to create. The possible values are `rsa` for RSA certificate or `ecc` for EC certificate.",
+              "type": "string",
+              "one_of": [
+                "rsa",
+                "ecc"
+              ],
+              "default": "rsa"
+            }
+          },
+          {
+            "rsa_key_size": {
+              "description": "RSA private key size for the certificate. The possible values are 2048, 3072, or 4096.",
+              "type": "number",
+              "one_of": [
+                2048,
+                3072,
+                4096
+              ],
+              "default": 4096
+            }
+          },
+          {
+            "renew_threshold_days": {
+              "description": "Days remaining to renew the certificate before it expires.",
+              "type": "number",
+              "default": 14
+            }
+          },
+          {
+            "domains": {
+              "description": "An array of strings representing hosts. A valid host is a string containing one or more labels separated by periods, with at most one wildcard label ('*')",
+              "type": "array",
+              "elements": {
+                "type": "string",
+                "match_all": [
+                  {
+                    "pattern": "^[^*]*%*?[^*]*$",
+                    "err": "invalid wildcard: must have at most one wildcard"
+                  }
+                ],
+                "match_any": {
+                  "patterns": [
+                    "^%*%.",
+                    "%.%*$",
+                    "^[^*]*$"
+                  ],
+                  "err": "invalid wildcard: must be placed at leftmost or rightmost label"
+                }
+              }
+            }
+          },
+          {
+            "allow_any_domain": {
+              "description": "If set to `true`, the plugin allows all domains and ignores any values in the `domains` list.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "fail_backoff_minutes": {
+              "description": "Minutes to wait for each domain that fails to create a certificate. This applies to both a\nnew certificate and a renewal certificate.",
+              "type": "number",
+              "default": 5
+            }
+          },
+          {
+            "storage": {
+              "description": "The backend storage type to use. In DB-less mode and Konnect, `kong` storage is unavailable. In hybrid mode and Konnect, `shm` storage is unavailable. `shm` storage does not persist during Kong restarts and does not work for Kong running on different machines, so consider using one of `kong`, `redis`, `consul`, or `vault` in production.",
+              "type": "string",
+              "one_of": [
+                "kong",
+                "shm",
+                "redis",
+                "consul",
+                "vault"
+              ],
+              "default": "shm"
+            }
+          },
+          {
+            "storage_config": {
+              "type": "record",
+              "fields": [
+                {
+                  "shm": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "shm_name": {
+                          "description": "Name of shared memory zone used for Kong API gateway storage",
+                          "type": "string",
+                          "default": "kong"
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "kong": {
+                    "type": "record",
+                    "fields": [],
+                    "required": true
+                  }
+                },
+                {
+                  "redis": {
+                    "shorthand_fields": [
+                      {
+                        "auth": {
+                          "type": "string",
+                          "len_min": 0,
+                          "deprecation": {
+                            "message": "acme: config.storage_config.redis.auth is deprecated, please use config.storage_config.redis.password instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "password"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "ssl_server_name": {
+                          "deprecation": {
+                            "message": "acme: config.storage_config.redis.ssl_server_name is deprecated, please use config.storage_config.redis.server_name instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "server_name"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "namespace": {
+                          "type": "string",
+                          "len_min": 0,
+                          "deprecation": {
+                            "message": "acme: config.storage_config.redis.namespace is deprecated, please use config.storage_config.redis.extra_options.namespace instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "extra_options",
+                                  "namespace"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "scan_count": {
+                          "deprecation": {
+                            "message": "acme: config.storage_config.redis.scan_count is deprecated, please use config.storage_config.redis.extra_options.scan_count instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "extra_options",
+                                  "scan_count"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "integer"
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ],
+                          "default": 6379
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                          "type": "string",
+                          "encrypted": true,
+                          "len_min": 0,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "Database to use for the Redis connection when using the `redis` strategy",
+                          "type": "integer",
+                          "default": 0
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "If set to true, uses SSL to connect to Redis.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "extra_options": {
+                          "description": "Custom ACME Redis options",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "namespace": {
+                                "description": "A namespace to prepend to all keys stored in Redis.",
+                                "type": "string",
+                                "len_min": 0,
+                                "required": true,
+                                "default": ""
+                              }
+                            },
+                            {
+                              "scan_count": {
+                                "description": "The number of keys to return in Redis SCAN calls.",
+                                "type": "number",
+                                "required": false,
+                                "default": 10
+                              }
+                            }
+                          ],
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "consul": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "https": {
+                          "description": "Boolean representation of https.",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ]
+                        }
+                      },
+                      {
+                        "kv_path": {
+                          "description": "KV prefix path.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "Timeout in milliseconds.",
+                          "type": "number"
+                        }
+                      },
+                      {
+                        "token": {
+                          "description": "Consul ACL token.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "vault": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "https": {
+                          "description": "Boolean representation of https.",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ]
+                        }
+                      },
+                      {
+                        "kv_path": {
+                          "description": "KV prefix path.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "Timeout in milliseconds.",
+                          "type": "number"
+                        }
+                      },
+                      {
+                        "token": {
+                          "description": "Consul ACL token.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "tls_verify": {
+                          "description": "Turn on TLS verification.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "tls_server_name": {
+                          "description": "SNI used in request, default to host if omitted.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "auth_method": {
+                          "description": "Auth Method, default to token, can be 'token' or 'kubernetes'.",
+                          "type": "string",
+                          "one_of": [
+                            "token",
+                            "kubernetes"
+                          ],
+                          "default": "token"
+                        }
+                      },
+                      {
+                        "auth_path": {
+                          "description": "Vault's authentication path to use.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "auth_role": {
+                          "description": "The role to try and assign.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "jwt_path": {
+                          "description": "The path to the JWT.",
+                          "type": "string"
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "preferred_chain": {
+              "description": "A string value that specifies the preferred certificate chain to use when generating certificates.",
+              "type": "string"
+            }
+          },
+          {
+            "enable_ipv4_common_name": {
+              "description": "A boolean value that controls whether to include the IPv4 address in the common name field of generated certificates.",
+              "type": "boolean",
+              "default": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ce": [
+      "config.storage_config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/ai-aws-guardrails/3.12.json b/schemas/ai-aws-guardrails/3.12.json
new file mode 100644
index 00000000..b86432f7
--- /dev/null
+++ b/schemas/ai-aws-guardrails/3.12.json
@@ -0,0 +1,141 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "guardrails_id": {
+              "description": "The guardrail identifier used in the request to apply the guardrail",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "guardrails_version": {
+              "description": "The guardrail version used in the request to apply the guardrail",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "stop_on_error": {
+              "description": "Stop processing if an error occurs",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "timeout": {
+              "description": "Connection timeout with the bedrock service",
+              "type": "number",
+              "required": true,
+              "default": 10000
+            }
+          },
+          {
+            "guarding_mode": {
+              "description": "The guardrail mode to use for the request",
+              "type": "string",
+              "one_of": [
+                "INPUT",
+                "OUTPUT",
+                "BOTH"
+              ],
+              "required": true,
+              "default": "INPUT"
+            }
+          },
+          {
+            "text_source": {
+              "description": "Select where to pick the 'text' for the Content Guard Services request.",
+              "type": "string",
+              "one_of": [
+                "concatenate_all_content",
+                "concatenate_user_content"
+              ],
+              "required": true,
+              "default": "concatenate_all_content"
+            }
+          },
+          {
+            "response_buffer_size": {
+              "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrails service. This only applies to the response content guard.",
+              "type": "number",
+              "required": true,
+              "default": 100
+            }
+          },
+          {
+            "aws_region": {
+              "description": "The AWS region to use for the Bedrock API",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "aws_access_key_id": {
+              "description": "The AWS access key ID to use for authentication",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "aws_secret_access_key": {
+              "description": "The AWS secret access key to use for authentication",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "aws_assume_role_arn": {
+              "description": "The target AWS IAM role ARN used to access the guardrails service",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "aws_role_session_name": {
+              "description": "The identifier of the assumed role session",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "aws_sts_endpoint_url": {
+              "description": "Override the STS endpoint URL when assuming a different role",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-azure-content-safety/3.12.json b/schemas/ai-azure-content-safety/3.12.json
new file mode 100644
index 00000000..3a0eaf29
--- /dev/null
+++ b/schemas/ai-azure-content-safety/3.12.json
@@ -0,0 +1,202 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "content_safety_url": {
+              "description": "Full URL, inc protocol, of the Azure Content Safety instance.",
+              "referenceable": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "azure_api_version": {
+              "description": "Sets the ?api-version URL parameter, used for defining the Azure Content Services interchange format.",
+              "type": "string",
+              "len_min": 1,
+              "default": "2023-10-01",
+              "required": true
+            }
+          },
+          {
+            "azure_use_managed_identity": {
+              "description": "If checked, uses (if set) `azure_client_id`, `azure_client_secret`, and/or `azure_tenant_id` for Azure authentication, via Managed or User-assigned identity",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "azure_client_id": {
+              "description": "If `azure_use_managed_identity` is true, set the client ID if required.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "azure_client_secret": {
+              "description": "If `azure_use_managed_identity` is true, set the client secret if required.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "azure_tenant_id": {
+              "description": "If `azure_use_managed_identity` is true, set the tenant ID if required.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "content_safety_key": {
+              "description": "If `azure_use_managed_identity` is true, set the API key to call Content Safety.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "text_source": {
+              "description": "Select where to pick the 'text' for the Azure Content Services request.",
+              "type": "string",
+              "one_of": [
+                "concatenate_all_content",
+                "concatenate_user_content"
+              ],
+              "default": "concatenate_all_content"
+            }
+          },
+          {
+            "categories": {
+              "description": "Array of categories, and their thresholds, to measure on.",
+              "type": "array",
+              "elements": {
+                "type": "record",
+                "fields": [
+                  {
+                    "name": {
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "rejection_level": {
+                      "required": true,
+                      "type": "integer"
+                    }
+                  }
+                ],
+                "required": true
+              }
+            }
+          },
+          {
+            "reveal_failure_reason": {
+              "description": "Set true to tell the caller why their request was rejected, if so.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "output_type": {
+              "description": "See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/content-filter#content-filtering-categories",
+              "type": "string",
+              "one_of": [
+                "FourSeverityLevels",
+                "EightSeverityLevels"
+              ],
+              "default": "FourSeverityLevels"
+            }
+          },
+          {
+            "blocklist_names": {
+              "description": "Use these configured blocklists (in Azure Content Services) when inspecting content.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "halt_on_blocklist_hit": {
+              "description": "Tells Azure to reject the request if any blocklist filter is hit.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "guarding_mode": {
+              "description": "The guard mode to use for the request",
+              "type": "string",
+              "one_of": [
+                "INPUT",
+                "OUTPUT",
+                "BOTH"
+              ],
+              "default": "INPUT",
+              "required": true
+            }
+          },
+          {
+            "stop_on_error": {
+              "description": "Stop processing if an error occurs",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "response_buffer_size": {
+              "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrails service. This only applies to the response content guard.",
+              "type": "number",
+              "default": 100,
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-llm-as-judge/.gitkeep b/schemas/ai-llm-as-judge/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/schemas/ai-llm-as-judge/3.12.json b/schemas/ai-llm-as-judge/3.12.json
new file mode 100644
index 00000000..f2abe1a6
--- /dev/null
+++ b/schemas/ai-llm-as-judge/3.12.json
@@ -0,0 +1,831 @@
+{
+  "entity_checks": [
+    {
+      "conditional": {
+        "then_field": "config.llm.route_type",
+        "then_err": "'config.llm.route_type' must be 'llm/v1/chat' for AI llm as judge plugins",
+        "then_match": {
+          "eq": "llm/v1/chat"
+        },
+        "if_match": {
+          "not_one_of": [
+            "llm/v1/chat"
+          ]
+        },
+        "if_field": "config.llm.route_type"
+      }
+    },
+    {
+      "mutually_required": [
+        "config.http_proxy_host",
+        "config.http_proxy_port"
+      ]
+    },
+    {
+      "mutually_required": [
+        "config.https_proxy_host",
+        "config.https_proxy_port"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "prompt": {
+              "description": "Use this prompt to tune the LLM system/assistant message for the llm as a judge prompt.",
+              "type": "string",
+              "required": true,
+              "default": "You are a strict evaluator. You will be given a prompt and a response. Your task is to judge whether the response is correct or incorrect. You must assign a score between 1 and 100, where: 100 represents a completely correct and ideal response, 1 represents a completely incorrect or irrelevant response. Your score must be a single number only — no text, labels, or explanations. Use the full range of values (e.g., 13, 47, 86), not just round numbers like 10, 50, or 100. Be accurate and consistent, as this score will be used by another model for learning and evaluation."
+            }
+          },
+          {
+            "message_countback": {
+              "description": "Number of messages in the chat history to use for evaluating the request",
+              "type": "number",
+              "default": 1,
+              "between": [
+                1,
+                1000
+              ],
+              "required": true
+            }
+          },
+          {
+            "ignore_system_prompts": {
+              "description": "Ignore and discard any system prompts when evaluating the request",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "ignore_assistant_prompts": {
+              "description": "Ignore and discard any assistant prompts when evaluating the request",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "ignore_tool_prompts": {
+              "description": "Ignore and discard any tool prompts when evaluating the request",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "http_timeout": {
+              "description": "Timeout in milliseconds for the AI upstream service.",
+              "type": "integer",
+              "required": true,
+              "default": 60000
+            }
+          },
+          {
+            "https_verify": {
+              "description": "Verify the TLS certificate of the AI upstream service.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "sampling_rate": {
+              "description": "Judging request sampling rate for configuring the probability-based sampler.",
+              "type": "number",
+              "default": 1,
+              "between": [
+                0,
+                1
+              ],
+              "required": false
+            }
+          },
+          {
+            "http_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "https_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "https_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "llm": {
+              "entity_checks": [
+                {
+                  "conditional": {
+                    "then_field": "auth.allow_override",
+                    "then_err": "bedrock and gemini only support auth.allow_override = false",
+                    "then_match": {
+                      "eq": false
+                    },
+                    "if_match": {
+                      "one_of": [
+                        "bedrock",
+                        "gemini"
+                      ]
+                    },
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "mutually_required": [
+                    "auth.header_name",
+                    "auth.header_value"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "auth.param_name",
+                    "auth.param_value",
+                    "auth.param_location"
+                  ]
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.llama2_format"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "llama2"
+                      ]
+                    },
+                    "then_err": "must set %s for llama2 provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.mistral_format"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "mistral"
+                      ]
+                    },
+                    "then_err": "must set %s for mistral provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.anthropic_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "anthropic"
+                      ]
+                    },
+                    "then_err": "must set %s for anthropic provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_instance"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_api_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_deployment_id"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.upstream_url"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "llama2"
+                      ]
+                    },
+                    "then_err": "must set %s for self-hosted providers/models",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model",
+                      "logging"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model"
+                    ]
+                  }
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "route_type": {
+                    "description": "The model's operation implementation, for this provider. ",
+                    "type": "string",
+                    "one_of": [
+                      "llm/v1/chat",
+                      "llm/v1/completions",
+                      "llm/v1/embeddings",
+                      "llm/v1/responses",
+                      "llm/v1/assistants",
+                      "llm/v1/batches",
+                      "llm/v1/files",
+                      "image/v1/images/generations",
+                      "image/v1/images/edits",
+                      "audio/v1/audio/transcriptions",
+                      "audio/v1/audio/speech",
+                      "audio/v1/audio/translations",
+                      "realtime/v1/realtime",
+                      "preserve"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "auth": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "header_name": {
+                          "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "header_value": {
+                          "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_name": {
+                          "description": "If AI model requires authentication via query parameter, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_value": {
+                          "description": "Specify the full parameter value for 'param_name'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_location": {
+                          "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                          "type": "string",
+                          "one_of": [
+                            "query",
+                            "body"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_use_managed_identity": {
+                          "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "azure_client_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_secret": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_tenant_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_use_service_account": {
+                          "description": "Use service account auth for GCP-based providers and models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "gcp_service_account_json": {
+                          "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_access_key_id": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_secret_access_key": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "allow_override": {
+                          "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "model": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "provider": {
+                          "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats.",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "azure",
+                            "anthropic",
+                            "cohere",
+                            "mistral",
+                            "llama2",
+                            "gemini",
+                            "bedrock",
+                            "huggingface"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "name": {
+                          "description": "Model name to execute.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "options": {
+                          "description": "Key/value settings for the model",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "max_tokens": {
+                                "description": "Defines the max_tokens, if using chat or completion models.",
+                                "type": "integer",
+                                "required": false
+                              }
+                            },
+                            {
+                              "input_cost": {
+                                "description": "Defines the cost per 1M tokens in your prompt.",
+                                "type": "number",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "output_cost": {
+                                "description": "Defines the cost per 1M tokens in the output of the AI.",
+                                "type": "number",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "temperature": {
+                                "description": "Defines the matching temperature, if using chat or completion models.",
+                                "type": "number",
+                                "between": [
+                                  0,
+                                  5
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "top_p": {
+                                "description": "Defines the top-p probability mass, if supported.",
+                                "type": "number",
+                                "between": [
+                                  0,
+                                  1
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "top_k": {
+                                "description": "Defines the top-k most likely tokens, if supported.",
+                                "type": "integer",
+                                "between": [
+                                  0,
+                                  500
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "anthropic_version": {
+                                "description": "Defines the schema/API version, if using Anthropic provider.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure_instance": {
+                                "description": "Instance name for Azure OpenAI hosted models.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure_api_version": {
+                                "description": "'api-version' for Azure OpenAI instances.",
+                                "type": "string",
+                                "required": false,
+                                "default": "2023-05-15"
+                              }
+                            },
+                            {
+                              "azure_deployment_id": {
+                                "description": "Deployment ID for Azure OpenAI instances.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "llama2_format": {
+                                "description": "If using llama2 provider, select the upstream message format.",
+                                "type": "string",
+                                "one_of": [
+                                  "raw",
+                                  "openai",
+                                  "ollama"
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "mistral_format": {
+                                "description": "If using mistral provider, select the upstream message format.",
+                                "type": "string",
+                                "one_of": [
+                                  "openai",
+                                  "ollama"
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "upstream_url": {
+                                "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "upstream_path": {
+                                "description": "Manually specify or override the AI operation path, used when e.g. using the 'preserve' route_type.",
+                                "type": "string",
+                                "required": false,
+                                "deprecation": {
+                                  "message": "llm: config.model.options.upstream_path is deprecated, please use config.model.options.upstream_url instead",
+                                  "removal_in_version": "4.0"
+                                }
+                              }
+                            },
+                            {
+                              "embeddings_dimensions": {
+                                "description": "If using embeddings models, set the number of dimensions to generate.",
+                                "type": "integer",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "gemini": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "api_endpoint",
+                                      "project_id",
+                                      "location_id"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "api_endpoint": {
+                                      "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "project_id": {
+                                      "description": "If running Gemini on Vertex, specify the project ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "location_id": {
+                                      "description": "If running Gemini on Vertex, specify the location ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "bedrock": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "aws_assume_role_arn",
+                                      "aws_role_session_name"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "aws_region": {
+                                      "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_assume_role_arn": {
+                                      "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_role_session_name": {
+                                      "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "aws_sts_endpoint_url": {
+                                      "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "embeddings_normalize": {
+                                      "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                      "type": "boolean",
+                                      "default": false
+                                    }
+                                  },
+                                  {
+                                    "performance_config_latency": {
+                                      "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "huggingface": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "use_cache": {
+                                      "description": "Use the cache layer on the inference API",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "cohere": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "embedding_input_type": {
+                                      "description": "The purpose of the input text to calculate embedding vectors.",
+                                      "type": "string",
+                                      "one_of": [
+                                        "search_document",
+                                        "search_query",
+                                        "classification",
+                                        "clustering",
+                                        "image"
+                                      ],
+                                      "default": "classification",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "logging": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "log_statistics": {
+                          "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log plugin(s) output.",
+                          "type": "boolean",
+                          "required": true,
+                          "default": false
+                        }
+                      },
+                      {
+                        "log_payloads": {
+                          "description": "If enabled, will log the request and response body into the Kong log plugin(s) output.",
+                          "type": "boolean",
+                          "required": true,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-prompt-compressor/3.12.json b/schemas/ai-prompt-compressor/3.12.json
new file mode 100644
index 00000000..613e71cb
--- /dev/null
+++ b/schemas/ai-prompt-compressor/3.12.json
@@ -0,0 +1,138 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "compressor_url": {
+              "description": "The url of the compressor",
+              "type": "string",
+              "default": "http://localhost:8080",
+              "required": true
+            }
+          },
+          {
+            "timeout": {
+              "description": "Connection timeout with the compressor",
+              "type": "number",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive_timeout": {
+              "description": "The keepalive timeout for the established http connnection",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "stop_on_error": {
+              "description": "Stop processing if an error occurs",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "log_text_data": {
+              "description": "Log the text data",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "message_type": {
+              "required": true,
+              "type": "set",
+              "elements": {
+                "one_of": [
+                  "system",
+                  "assistant",
+                  "user"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "user"
+              ]
+            }
+          },
+          {
+            "compressor_type": {
+              "description": "What compression type to use to compress with",
+              "type": "string",
+              "one_of": [
+                "rate",
+                "target_token"
+              ],
+              "required": true,
+              "default": "rate"
+            }
+          },
+          {
+            "compression_ranges": {
+              "description": "What value to be used to compress with. The 'value' is interpreted as rate or target_token depending on compressor_type.",
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "min_tokens": {
+                      "type": "integer",
+                      "required": true
+                    }
+                  },
+                  {
+                    "max_tokens": {
+                      "type": "integer",
+                      "required": true
+                    }
+                  },
+                  {
+                    "value": {
+                      "type": "number",
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-prompt-decorator/3.12.json b/schemas/ai-prompt-decorator/3.12.json
new file mode 100644
index 00000000..df32129a
--- /dev/null
+++ b/schemas/ai-prompt-decorator/3.12.json
@@ -0,0 +1,141 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.prompts.prepend",
+        "config.prompts.append"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "prompts": {
+              "type": "record",
+              "fields": [
+                {
+                  "prepend": {
+                    "description": "Insert chat messages at the beginning of the chat message array. This array preserves exact order when adding messages.",
+                    "type": "array",
+                    "len_max": 15,
+                    "elements": {
+                      "type": "record",
+                      "fields": [
+                        {
+                          "role": {
+                            "default": "system",
+                            "type": "string",
+                            "one_of": [
+                              "system",
+                              "assistant",
+                              "user"
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "content": {
+                            "type": "string",
+                            "len_min": 1,
+                            "len_max": 100000,
+                            "required": true
+                          }
+                        }
+                      ],
+                      "required": false
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "append": {
+                    "description": "Insert chat messages at the end of the chat message array. This array preserves exact order when adding messages.",
+                    "type": "array",
+                    "len_max": 15,
+                    "elements": {
+                      "type": "record",
+                      "fields": [
+                        {
+                          "role": {
+                            "default": "system",
+                            "type": "string",
+                            "one_of": [
+                              "system",
+                              "assistant",
+                              "user"
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "content": {
+                            "type": "string",
+                            "len_min": 1,
+                            "len_max": 100000,
+                            "required": true
+                          }
+                        }
+                      ],
+                      "required": false
+                    },
+                    "required": false
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "max_request_body_size": {
+              "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+              "type": "integer",
+              "gt": 0,
+              "default": 8192
+            }
+          },
+          {
+            "llm_format": {
+              "description": "LLM input and output format and schema to use",
+              "type": "string",
+              "one_of": [
+                "openai",
+                "bedrock",
+                "gemini",
+                "cohere",
+                "huggingface"
+              ],
+              "required": false,
+              "default": "openai"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-prompt-guard/3.12.json b/schemas/ai-prompt-guard/3.12.json
new file mode 100644
index 00000000..d19969f5
--- /dev/null
+++ b/schemas/ai-prompt-guard/3.12.json
@@ -0,0 +1,136 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.allow_patterns",
+        "config.deny_patterns"
+      ]
+    },
+    {
+      "conditional": {
+        "then_field": "config.allow_all_conversation_history",
+        "if_match": {
+          "eq": true
+        },
+        "then_match": {
+          "eq": false
+        },
+        "if_field": "config.match_all_roles"
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "allow_patterns": {
+              "description": "Array of valid regex patterns, or valid questions from the 'user' role in chat.",
+              "type": "array",
+              "len_max": 10,
+              "elements": {
+                "type": "string",
+                "len_max": 500,
+                "len_min": 1
+              },
+              "required": false
+            }
+          },
+          {
+            "deny_patterns": {
+              "description": "Array of invalid regex patterns, or invalid questions from the 'user' role in chat.",
+              "type": "array",
+              "len_max": 10,
+              "elements": {
+                "type": "string",
+                "len_max": 500,
+                "len_min": 1
+              },
+              "required": false
+            }
+          },
+          {
+            "allow_all_conversation_history": {
+              "description": "If true, will ignore all previous chat prompts from the conversation history.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "max_request_body_size": {
+              "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+              "type": "integer",
+              "gt": 0,
+              "default": 8192
+            }
+          },
+          {
+            "match_all_roles": {
+              "description": "If true, will match all roles in addition to 'user' role in conversation history.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "llm_format": {
+              "description": "LLM input and output format and schema to use",
+              "type": "string",
+              "one_of": [
+                "openai",
+                "bedrock",
+                "gemini",
+                "cohere",
+                "huggingface"
+              ],
+              "required": false,
+              "default": "openai"
+            }
+          },
+          {
+            "genai_category": {
+              "description": "Generative AI category of the request",
+              "type": "string",
+              "one_of": [
+                "text/generation",
+                "text/embeddings",
+                "audio/transcription",
+                "audio/speech",
+                "image/generation",
+                "video/generation",
+                "realtime/generation"
+              ],
+              "required": false,
+              "default": "text/generation"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-prompt-template/3.12.json b/schemas/ai-prompt-template/3.12.json
new file mode 100644
index 00000000..022cbb4f
--- /dev/null
+++ b/schemas/ai-prompt-template/3.12.json
@@ -0,0 +1,86 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "templates": {
+              "description": "Array of templates available to the request context.",
+              "type": "array",
+              "elements": {
+                "type": "record",
+                "fields": [
+                  {
+                    "name": {
+                      "description": "Unique name for the template, can be called with `{template://NAME}`",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "template": {
+                      "description": "Template string for this request, supports mustache-style `{{placeholders}}`",
+                      "type": "string",
+                      "required": true
+                    }
+                  }
+                ],
+                "required": true
+              },
+              "required": true
+            }
+          },
+          {
+            "allow_untemplated_requests": {
+              "description": "Set true to allow requests that don't call or match any template.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "log_original_request": {
+              "description": "Set true to add the original request to the Kong log plugin(s) output.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "max_request_body_size": {
+              "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+              "type": "integer",
+              "gt": 0,
+              "default": 8192
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-proxy-advanced/3.12.json b/schemas/ai-proxy-advanced/3.12.json
new file mode 100644
index 00000000..7d01712a
--- /dev/null
+++ b/schemas/ai-proxy-advanced/3.12.json
@@ -0,0 +1,1841 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.targets",
+          "config.balancer"
+        ]
+      }
+    },
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.targets",
+          "config.balancer"
+        ]
+      }
+    },
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.targets",
+          "config.llm_format"
+        ]
+      }
+    },
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.genai_category",
+          "config.targets"
+        ]
+      }
+    },
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.model_name_header",
+          "config.targets"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "balancer": {
+              "type": "record",
+              "fields": [
+                {
+                  "algorithm": {
+                    "description": "Which load balancing algorithm to use.",
+                    "type": "string",
+                    "one_of": [
+                      "round-robin",
+                      "lowest-latency",
+                      "lowest-usage",
+                      "consistent-hashing",
+                      "semantic",
+                      "priority"
+                    ],
+                    "default": "round-robin"
+                  }
+                },
+                {
+                  "tokens_count_strategy": {
+                    "description": "What tokens to use for usage calculation. Available values are: `total_tokens` `prompt_tokens`, `completion_tokens` and `cost`.",
+                    "type": "string",
+                    "one_of": [
+                      "total-tokens",
+                      "prompt-tokens",
+                      "completion-tokens",
+                      "cost",
+                      "llm-accuracy"
+                    ],
+                    "default": "total-tokens"
+                  }
+                },
+                {
+                  "latency_strategy": {
+                    "description": "What metrics to use for latency. Available values are: `tpot` (time-per-output-token) and `e2e`.",
+                    "type": "string",
+                    "one_of": [
+                      "tpot",
+                      "e2e"
+                    ],
+                    "default": "tpot"
+                  }
+                },
+                {
+                  "hash_on_header": {
+                    "description": "The header to use for consistent-hashing.",
+                    "type": "string",
+                    "default": "X-Kong-LLM-Request-ID"
+                  }
+                },
+                {
+                  "slots": {
+                    "description": "The number of slots in the load balancer algorithm.",
+                    "type": "integer",
+                    "between": [
+                      10,
+                      65536
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "retries": {
+                    "description": "The number of retries to execute upon failure to proxy.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      32767
+                    ],
+                    "default": 5
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 60000
+                  }
+                },
+                {
+                  "write_timeout": {
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 60000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 60000
+                  }
+                },
+                {
+                  "failover_criteria": {
+                    "description": "Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream",
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "error",
+                        "timeout",
+                        "invalid_header",
+                        "http_500",
+                        "http_502",
+                        "http_503",
+                        "http_504",
+                        "http_403",
+                        "http_404",
+                        "http_429",
+                        "non_idempotent"
+                      ],
+                      "type": "string"
+                    },
+                    "default": [
+                      "error",
+                      "timeout"
+                    ]
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "embeddings": {
+              "entity_checks": [
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.instance"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.api_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.deployment_id"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "auth": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "header_name": {
+                          "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "header_value": {
+                          "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_name": {
+                          "description": "If AI model requires authentication via query parameter, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_value": {
+                          "description": "Specify the full parameter value for 'param_name'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_location": {
+                          "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                          "type": "string",
+                          "one_of": [
+                            "query",
+                            "body"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_use_managed_identity": {
+                          "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_secret": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_tenant_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_use_service_account": {
+                          "description": "Use service account auth for GCP-based providers and models.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_service_account_json": {
+                          "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_access_key_id": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_secret_access_key": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "allow_override": {
+                          "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "model": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "provider": {
+                          "description": "AI provider format to use for embeddings API",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "mistral",
+                            "huggingface",
+                            "azure",
+                            "bedrock",
+                            "gemini"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "name": {
+                          "description": "Model name to execute.",
+                          "type": "string",
+                          "required": true
+                        }
+                      },
+                      {
+                        "options": {
+                          "description": "Key/value settings for the model",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "upstream_url": {
+                                "description": "upstream url for the embeddings",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "instance": {
+                                      "description": "Instance name for Azure OpenAI hosted models.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "api_version": {
+                                      "description": "'api-version' for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "default": "2023-05-15",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "deployment_id": {
+                                      "description": "Deployment ID for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": true
+                              }
+                            },
+                            {
+                              "bedrock": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "aws_assume_role_arn",
+                                      "aws_role_session_name"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "aws_region": {
+                                      "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_assume_role_arn": {
+                                      "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_role_session_name": {
+                                      "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "aws_sts_endpoint_url": {
+                                      "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "embeddings_normalize": {
+                                      "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                      "type": "boolean",
+                                      "default": false
+                                    }
+                                  },
+                                  {
+                                    "performance_config_latency": {
+                                      "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "gemini": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "api_endpoint",
+                                      "project_id",
+                                      "location_id"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "api_endpoint": {
+                                      "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "project_id": {
+                                      "description": "If running Gemini on Vertex, specify the project ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "location_id": {
+                                      "description": "If running Gemini on Vertex, specify the location ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "huggingface": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "use_cache": {
+                                      "description": "Use the cache layer on the inference API",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "vectordb": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "which vector database driver to use",
+                    "type": "string",
+                    "one_of": [
+                      "redis",
+                      "pgvector"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "dimensions": {
+                    "description": "the desired dimensionality for the vectors",
+                    "type": "integer",
+                    "required": true
+                  }
+                },
+                {
+                  "threshold": {
+                    "description": "the default similarity threshold for accepting semantic search results (float)",
+                    "type": "number",
+                    "required": true
+                  }
+                },
+                {
+                  "distance_metric": {
+                    "description": "the distance metric to use for vector searches",
+                    "type": "string",
+                    "one_of": [
+                      "cosine",
+                      "euclidean"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "redis": {
+                    "entity_checks": [
+                      {
+                        "mutually_required": [
+                          "host",
+                          "port"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "sentinel_master",
+                          "sentinel_role",
+                          "sentinel_nodes"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "connect_timeout",
+                          "send_timeout",
+                          "read_timeout"
+                        ]
+                      },
+                      {
+                        "conditional": {
+                          "then_field": "host",
+                          "if_match": {
+                            "eq": true
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "connection_is_proxied"
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "database",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "cluster_nodes",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "sentinel_role",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "shorthand_fields": [
+                      {
+                        "timeout": {
+                          "deprecation": {
+                            "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "connect_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "send_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "read_timeout"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "integer"
+                        }
+                      },
+                      {
+                        "sentinel_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "sentinel_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "cluster_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "cluster_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      }
+                    ],
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ],
+                          "default": 6379
+                        }
+                      },
+                      {
+                        "connect_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "send_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "read_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_username": {
+                          "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_password": {
+                          "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "Database to use for the Redis connection when using the `redis` strategy",
+                          "type": "integer",
+                          "default": 0
+                        }
+                      },
+                      {
+                        "keepalive_pool_size": {
+                          "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                          "type": "integer",
+                          "between": [
+                            1,
+                            2147483646
+                          ],
+                          "default": 256
+                        }
+                      },
+                      {
+                        "keepalive_backlog": {
+                          "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_master": {
+                          "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "sentinel_role": {
+                          "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                          "type": "string",
+                          "one_of": [
+                            "master",
+                            "slave",
+                            "any"
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_nodes": {
+                          "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "host": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "default": "127.0.0.1",
+                                  "required": true
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_nodes": {
+                          "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "ip": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "default": "127.0.0.1",
+                                  "required": true
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "If set to true, uses SSL to connect to Redis.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      },
+                      {
+                        "server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_max_redirections": {
+                          "description": "Maximum retry attempts for redirection.",
+                          "type": "integer",
+                          "required": false,
+                          "default": 5
+                        }
+                      },
+                      {
+                        "connection_is_proxied": {
+                          "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "pgvector": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "the host of the pgvector database",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "the port of the pgvector database",
+                          "type": "integer",
+                          "default": 5432
+                        }
+                      },
+                      {
+                        "user": {
+                          "description": "the user of the pgvector database",
+                          "type": "string",
+                          "referenceable": true,
+                          "default": "postgres"
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "the password of the pgvector database",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "the database of the pgvector database",
+                          "type": "string",
+                          "default": "kong-pgvector"
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "the timeout of the pgvector database",
+                          "type": "number",
+                          "default": 5000
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "whether to use ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_required": {
+                          "description": "whether ssl is required for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "whether to verify ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_version": {
+                          "description": "the ssl version to use for the pgvector database",
+                          "type": "string",
+                          "one_of": [
+                            "tlsv1_2",
+                            "tlsv1_3",
+                            "any"
+                          ],
+                          "default": "tlsv1_2"
+                        }
+                      },
+                      {
+                        "ssl_cert": {
+                          "description": "the path of ssl cert to use for the pgvector database",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "ssl_cert_key": {
+                          "description": "the path of ssl cert key to use for the pgvector database",
+                          "type": "string"
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "response_streaming": {
+              "description": "Whether to 'optionally allow', 'deny', or 'always' (force) the streaming of answers via server sent events.",
+              "type": "string",
+              "one_of": [
+                "allow",
+                "deny",
+                "always"
+              ],
+              "required": false,
+              "default": "allow"
+            }
+          },
+          {
+            "max_request_body_size": {
+              "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+              "type": "integer",
+              "gt": 0,
+              "default": 8192
+            }
+          },
+          {
+            "model_name_header": {
+              "description": "Display the model name selected in the X-Kong-LLM-Model response header",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "targets": {
+              "type": "array",
+              "elements": {
+                "entity_checks": [
+                  {
+                    "conditional": {
+                      "then_field": "auth.allow_override",
+                      "then_err": "bedrock and gemini only support auth.allow_override = false",
+                      "then_match": {
+                        "eq": false
+                      },
+                      "if_match": {
+                        "one_of": [
+                          "bedrock",
+                          "gemini"
+                        ]
+                      },
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "mutually_required": [
+                      "auth.header_name",
+                      "auth.header_value"
+                    ]
+                  },
+                  {
+                    "mutually_required": [
+                      "auth.param_name",
+                      "auth.param_value",
+                      "auth.param_location"
+                    ]
+                  },
+                  {
+                    "conditional_at_least_one_of": {
+                      "then_at_least_one_of": [
+                        "model.options.llama2_format"
+                      ],
+                      "if_match": {
+                        "one_of": [
+                          "llama2"
+                        ]
+                      },
+                      "then_err": "must set %s for llama2 provider",
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "conditional_at_least_one_of": {
+                      "then_at_least_one_of": [
+                        "model.options.mistral_format"
+                      ],
+                      "if_match": {
+                        "one_of": [
+                          "mistral"
+                        ]
+                      },
+                      "then_err": "must set %s for mistral provider",
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "conditional_at_least_one_of": {
+                      "then_at_least_one_of": [
+                        "model.options.anthropic_version"
+                      ],
+                      "if_match": {
+                        "one_of": [
+                          "anthropic"
+                        ]
+                      },
+                      "then_err": "must set %s for anthropic provider",
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "conditional_at_least_one_of": {
+                      "then_at_least_one_of": [
+                        "model.options.azure_instance"
+                      ],
+                      "if_match": {
+                        "one_of": [
+                          "azure"
+                        ]
+                      },
+                      "then_err": "must set %s for azure provider",
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "conditional_at_least_one_of": {
+                      "then_at_least_one_of": [
+                        "model.options.azure_api_version"
+                      ],
+                      "if_match": {
+                        "one_of": [
+                          "azure"
+                        ]
+                      },
+                      "then_err": "must set %s for azure provider",
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "conditional_at_least_one_of": {
+                      "then_at_least_one_of": [
+                        "model.options.azure_deployment_id"
+                      ],
+                      "if_match": {
+                        "one_of": [
+                          "azure"
+                        ]
+                      },
+                      "then_err": "must set %s for azure provider",
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "conditional_at_least_one_of": {
+                      "then_at_least_one_of": [
+                        "model.options.upstream_url"
+                      ],
+                      "if_match": {
+                        "one_of": [
+                          "llama2"
+                        ]
+                      },
+                      "then_err": "must set %s for self-hosted providers/models",
+                      "if_field": "model.provider"
+                    }
+                  },
+                  {
+                    "custom_entity_check": {
+                      "field_sources": [
+                        "route_type",
+                        "model",
+                        "logging"
+                      ]
+                    }
+                  },
+                  {
+                    "custom_entity_check": {
+                      "field_sources": [
+                        "route_type"
+                      ]
+                    }
+                  },
+                  {
+                    "custom_entity_check": {
+                      "field_sources": [
+                        "route_type",
+                        "model"
+                      ]
+                    }
+                  },
+                  {
+                    "custom_entity_check": {
+                      "field_sources": [
+                        "route_type",
+                        "model"
+                      ]
+                    }
+                  }
+                ],
+                "type": "record",
+                "fields": [
+                  {
+                    "route_type": {
+                      "description": "The model's operation implementation, for this provider. ",
+                      "type": "string",
+                      "one_of": [
+                        "llm/v1/chat",
+                        "llm/v1/completions",
+                        "llm/v1/embeddings",
+                        "llm/v1/responses",
+                        "llm/v1/assistants",
+                        "llm/v1/batches",
+                        "llm/v1/files",
+                        "image/v1/images/generations",
+                        "image/v1/images/edits",
+                        "audio/v1/audio/transcriptions",
+                        "audio/v1/audio/speech",
+                        "audio/v1/audio/translations",
+                        "realtime/v1/realtime",
+                        "preserve"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "auth": {
+                      "type": "record",
+                      "fields": [
+                        {
+                          "header_name": {
+                            "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                            "type": "string",
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "header_value": {
+                            "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                            "type": "string",
+                            "encrypted": true,
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "param_name": {
+                            "description": "If AI model requires authentication via query parameter, specify its name here.",
+                            "type": "string",
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "param_value": {
+                            "description": "Specify the full parameter value for 'param_name'.",
+                            "type": "string",
+                            "encrypted": true,
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "param_location": {
+                            "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                            "type": "string",
+                            "one_of": [
+                              "query",
+                              "body"
+                            ],
+                            "required": false
+                          }
+                        },
+                        {
+                          "azure_use_managed_identity": {
+                            "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                            "type": "boolean",
+                            "default": false,
+                            "required": false
+                          }
+                        },
+                        {
+                          "azure_client_id": {
+                            "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                            "type": "string",
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "azure_client_secret": {
+                            "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                            "type": "string",
+                            "encrypted": true,
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "azure_tenant_id": {
+                            "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                            "type": "string",
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "gcp_use_service_account": {
+                            "description": "Use service account auth for GCP-based providers and models.",
+                            "type": "boolean",
+                            "default": false,
+                            "required": false
+                          }
+                        },
+                        {
+                          "gcp_service_account_json": {
+                            "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                            "type": "string",
+                            "encrypted": true,
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "aws_access_key_id": {
+                            "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                            "type": "string",
+                            "encrypted": true,
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "aws_secret_access_key": {
+                            "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                            "type": "string",
+                            "encrypted": true,
+                            "referenceable": true,
+                            "required": false
+                          }
+                        },
+                        {
+                          "allow_override": {
+                            "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                            "type": "boolean",
+                            "default": false,
+                            "required": false
+                          }
+                        }
+                      ],
+                      "required": false
+                    }
+                  },
+                  {
+                    "model": {
+                      "type": "record",
+                      "fields": [
+                        {
+                          "provider": {
+                            "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats.",
+                            "type": "string",
+                            "one_of": [
+                              "openai",
+                              "azure",
+                              "anthropic",
+                              "cohere",
+                              "mistral",
+                              "llama2",
+                              "gemini",
+                              "bedrock",
+                              "huggingface"
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "name": {
+                            "description": "Model name to execute.",
+                            "type": "string",
+                            "required": false
+                          }
+                        },
+                        {
+                          "options": {
+                            "description": "Key/value settings for the model",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "max_tokens": {
+                                  "description": "Defines the max_tokens, if using chat or completion models.",
+                                  "type": "integer",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "input_cost": {
+                                  "description": "Defines the cost per 1M tokens in your prompt.",
+                                  "type": "number",
+                                  "gt": 0,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "output_cost": {
+                                  "description": "Defines the cost per 1M tokens in the output of the AI.",
+                                  "type": "number",
+                                  "gt": 0,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "temperature": {
+                                  "description": "Defines the matching temperature, if using chat or completion models.",
+                                  "type": "number",
+                                  "between": [
+                                    0,
+                                    5
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "top_p": {
+                                  "description": "Defines the top-p probability mass, if supported.",
+                                  "type": "number",
+                                  "between": [
+                                    0,
+                                    1
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "top_k": {
+                                  "description": "Defines the top-k most likely tokens, if supported.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    500
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "anthropic_version": {
+                                  "description": "Defines the schema/API version, if using Anthropic provider.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "azure_instance": {
+                                  "description": "Instance name for Azure OpenAI hosted models.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "azure_api_version": {
+                                  "description": "'api-version' for Azure OpenAI instances.",
+                                  "type": "string",
+                                  "default": "2023-05-15",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "azure_deployment_id": {
+                                  "description": "Deployment ID for Azure OpenAI instances.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "llama2_format": {
+                                  "description": "If using llama2 provider, select the upstream message format.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "raw",
+                                    "openai",
+                                    "ollama"
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "mistral_format": {
+                                  "description": "If using mistral provider, select the upstream message format.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "openai",
+                                    "ollama"
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_url": {
+                                  "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_path": {
+                                  "description": "Manually specify or override the AI operation path, used when e.g. using the 'preserve' route_type.",
+                                  "type": "string",
+                                  "deprecation": {
+                                    "message": "llm: config.model.options.upstream_path is deprecated, please use config.model.options.upstream_url instead",
+                                    "removal_in_version": "4.0"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "embeddings_dimensions": {
+                                  "description": "If using embeddings models, set the number of dimensions to generate.",
+                                  "type": "integer",
+                                  "gt": 0,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "gemini": {
+                                  "entity_checks": [
+                                    {
+                                      "mutually_required": [
+                                        "api_endpoint",
+                                        "project_id",
+                                        "location_id"
+                                      ]
+                                    }
+                                  ],
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "api_endpoint": {
+                                        "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "project_id": {
+                                        "description": "If running Gemini on Vertex, specify the project ID.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "location_id": {
+                                        "description": "If running Gemini on Vertex, specify the location ID.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    }
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "bedrock": {
+                                  "entity_checks": [
+                                    {
+                                      "mutually_required": [
+                                        "aws_assume_role_arn",
+                                        "aws_role_session_name"
+                                      ]
+                                    }
+                                  ],
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "aws_region": {
+                                        "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "aws_assume_role_arn": {
+                                        "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "aws_role_session_name": {
+                                        "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "aws_sts_endpoint_url": {
+                                        "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "embeddings_normalize": {
+                                        "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                        "type": "boolean",
+                                        "default": false
+                                      }
+                                    },
+                                    {
+                                      "performance_config_latency": {
+                                        "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    }
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "huggingface": {
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "use_cache": {
+                                        "description": "Use the cache layer on the inference API",
+                                        "type": "boolean",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "wait_for_model": {
+                                        "description": "Wait for the model if it is not ready",
+                                        "type": "boolean",
+                                        "required": false
+                                      }
+                                    }
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cohere": {
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "embedding_input_type": {
+                                        "description": "The purpose of the input text to calculate embedding vectors.",
+                                        "type": "string",
+                                        "one_of": [
+                                          "search_document",
+                                          "search_query",
+                                          "classification",
+                                          "clustering",
+                                          "image"
+                                        ],
+                                        "required": false,
+                                        "default": "classification"
+                                      }
+                                    },
+                                    {
+                                      "wait_for_model": {
+                                        "description": "Wait for the model if it is not ready",
+                                        "type": "boolean",
+                                        "required": false
+                                      }
+                                    }
+                                  ],
+                                  "required": false
+                                }
+                              }
+                            ],
+                            "required": false
+                          }
+                        }
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "weight": {
+                      "description": "The weight this target gets within the upstream loadbalancer (1-65535).",
+                      "type": "integer",
+                      "between": [
+                        1,
+                        65535
+                      ],
+                      "default": 100
+                    }
+                  },
+                  {
+                    "description": {
+                      "description": "The semantic description of the target, required if using semantic load balancing. Specially, setting this to 'CATCHALL' will indicate such target to be used when no other targets match the semantic threshold.",
+                      "type": "string",
+                      "required": false
+                    }
+                  },
+                  {
+                    "logging": {
+                      "type": "record",
+                      "fields": [
+                        {
+                          "log_statistics": {
+                            "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log plugin(s) output.",
+                            "type": "boolean",
+                            "default": false,
+                            "required": true
+                          }
+                        },
+                        {
+                          "log_payloads": {
+                            "description": "If enabled, will log the request and response body into the Kong log plugin(s) output.",
+                            "type": "boolean",
+                            "default": false,
+                            "required": true
+                          }
+                        }
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "required": true
+              },
+              "required": true
+            }
+          },
+          {
+            "llm_format": {
+              "description": "LLM input and output format and schema to use",
+              "type": "string",
+              "one_of": [
+                "openai",
+                "bedrock",
+                "gemini",
+                "cohere",
+                "huggingface"
+              ],
+              "required": false,
+              "default": "openai"
+            }
+          },
+          {
+            "genai_category": {
+              "description": "Generative AI category of the request",
+              "type": "string",
+              "one_of": [
+                "text/generation",
+                "text/embeddings",
+                "audio/transcription",
+                "audio/speech",
+                "image/generation",
+                "video/generation",
+                "realtime/generation"
+              ],
+              "required": false,
+              "default": "text/generation"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-proxy/3.12.json b/schemas/ai-proxy/3.12.json
new file mode 100644
index 00000000..7386de0d
--- /dev/null
+++ b/schemas/ai-proxy/3.12.json
@@ -0,0 +1,907 @@
+{
+  "entity_checks": [
+    {
+      "conditional": {
+        "then_field": "config.model.provider",
+        "then_err": "native llm_format 'bedrock' can only be used with the 'bedrock' model.provider",
+        "then_match": {
+          "eq": "bedrock"
+        },
+        "if_match": {
+          "eq": "bedrock"
+        },
+        "if_field": "config.llm_format"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.model.provider",
+        "then_err": "native llm_format 'gemini' can only be used with the 'gemini' model.provider",
+        "then_match": {
+          "eq": "gemini"
+        },
+        "if_match": {
+          "eq": "gemini"
+        },
+        "if_field": "config.llm_format"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.model.provider",
+        "then_err": "native llm_format 'cohere' can only be used with the 'cohere' model.provider",
+        "then_match": {
+          "eq": "cohere"
+        },
+        "if_match": {
+          "eq": "cohere"
+        },
+        "if_field": "config.llm_format"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.model.provider",
+        "then_err": "native llm_format 'huggingface' can only be used with the 'huggingface' model.provider",
+        "then_match": {
+          "eq": "huggingface"
+        },
+        "if_match": {
+          "eq": "huggingface"
+        },
+        "if_field": "config.llm_format"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.model_name_header",
+        "then_err": "current route type doesn't have model name thus can't return model_name_header",
+        "then_match": {
+          "eq": false
+        },
+        "if_match": {
+          "one_of": [
+            "llm/v1/assistants",
+            "llm/v1/files",
+            "llm/v1/batches"
+          ]
+        },
+        "if_field": "config.route_type"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.route_type",
+        "then_err": "category 'text/generation' cannot be used with this route_type",
+        "then_match": {
+          "one_of": [
+            "llm/v1/chat",
+            "llm/v1/completions",
+            "llm/v1/responses",
+            "llm/v1/assistants",
+            "llm/v1/files",
+            "llm/v1/batches",
+            "preserve"
+          ]
+        },
+        "if_match": {
+          "eq": "text/generation"
+        },
+        "if_field": "config.genai_category"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.route_type",
+        "then_err": "category 'text/embeddings' cannot be used with this route_type",
+        "then_match": {
+          "eq": "llm/v1/embeddings"
+        },
+        "if_match": {
+          "eq": "text/embeddings"
+        },
+        "if_field": "config.genai_category"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.route_type",
+        "then_err": "category 'image/generation' cannot be used with this route_type",
+        "then_match": {
+          "one_of": [
+            "image/v1/images/generations",
+            "image/v1/images/edits"
+          ]
+        },
+        "if_match": {
+          "eq": "image/generation"
+        },
+        "if_field": "config.genai_category"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.route_type",
+        "then_err": "category 'audio/speech' cannot be used with this route_type",
+        "then_match": {
+          "one_of": [
+            "audio/v1/audio/speech"
+          ]
+        },
+        "if_match": {
+          "eq": "audio/speech"
+        },
+        "if_field": "config.genai_category"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.route_type",
+        "then_err": "category 'audio/transcription' cannot be used with this route_type",
+        "then_match": {
+          "one_of": [
+            "audio/v1/audio/transcriptions",
+            "audio/v1/audio/translations"
+          ]
+        },
+        "if_match": {
+          "eq": "audio/transcription"
+        },
+        "if_field": "config.genai_category"
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "conditional": {
+              "then_field": "auth.allow_override",
+              "then_err": "bedrock and gemini only support auth.allow_override = false",
+              "then_match": {
+                "eq": false
+              },
+              "if_match": {
+                "one_of": [
+                  "bedrock",
+                  "gemini"
+                ]
+              },
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "mutually_required": [
+              "auth.header_name",
+              "auth.header_value"
+            ]
+          },
+          {
+            "mutually_required": [
+              "auth.param_name",
+              "auth.param_value",
+              "auth.param_location"
+            ]
+          },
+          {
+            "conditional_at_least_one_of": {
+              "then_at_least_one_of": [
+                "model.options.llama2_format"
+              ],
+              "if_match": {
+                "one_of": [
+                  "llama2"
+                ]
+              },
+              "then_err": "must set %s for llama2 provider",
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "conditional_at_least_one_of": {
+              "then_at_least_one_of": [
+                "model.options.mistral_format"
+              ],
+              "if_match": {
+                "one_of": [
+                  "mistral"
+                ]
+              },
+              "then_err": "must set %s for mistral provider",
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "conditional_at_least_one_of": {
+              "then_at_least_one_of": [
+                "model.options.anthropic_version"
+              ],
+              "if_match": {
+                "one_of": [
+                  "anthropic"
+                ]
+              },
+              "then_err": "must set %s for anthropic provider",
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "conditional_at_least_one_of": {
+              "then_at_least_one_of": [
+                "model.options.azure_instance"
+              ],
+              "if_match": {
+                "one_of": [
+                  "azure"
+                ]
+              },
+              "then_err": "must set %s for azure provider",
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "conditional_at_least_one_of": {
+              "then_at_least_one_of": [
+                "model.options.azure_api_version"
+              ],
+              "if_match": {
+                "one_of": [
+                  "azure"
+                ]
+              },
+              "then_err": "must set %s for azure provider",
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "conditional_at_least_one_of": {
+              "then_at_least_one_of": [
+                "model.options.azure_deployment_id"
+              ],
+              "if_match": {
+                "one_of": [
+                  "azure"
+                ]
+              },
+              "then_err": "must set %s for azure provider",
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "conditional_at_least_one_of": {
+              "then_at_least_one_of": [
+                "model.options.upstream_url"
+              ],
+              "if_match": {
+                "one_of": [
+                  "llama2"
+                ]
+              },
+              "then_err": "must set %s for self-hosted providers/models",
+              "if_field": "model.provider"
+            }
+          },
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "route_type",
+                "model",
+                "logging"
+              ]
+            }
+          },
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "route_type"
+              ]
+            }
+          },
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "route_type",
+                "model"
+              ]
+            }
+          },
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "route_type",
+                "model"
+              ]
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "route_type": {
+              "description": "The model's operation implementation, for this provider. ",
+              "type": "string",
+              "one_of": [
+                "llm/v1/chat",
+                "llm/v1/completions",
+                "llm/v1/embeddings",
+                "llm/v1/responses",
+                "llm/v1/assistants",
+                "llm/v1/batches",
+                "llm/v1/files",
+                "image/v1/images/generations",
+                "image/v1/images/edits",
+                "audio/v1/audio/transcriptions",
+                "audio/v1/audio/speech",
+                "audio/v1/audio/translations",
+                "realtime/v1/realtime",
+                "preserve"
+              ],
+              "required": true
+            }
+          },
+          {
+            "auth": {
+              "type": "record",
+              "fields": [
+                {
+                  "header_name": {
+                    "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                    "type": "string",
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "header_value": {
+                    "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "param_name": {
+                    "description": "If AI model requires authentication via query parameter, specify its name here.",
+                    "type": "string",
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "param_value": {
+                    "description": "Specify the full parameter value for 'param_name'.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "param_location": {
+                    "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                    "type": "string",
+                    "one_of": [
+                      "query",
+                      "body"
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "azure_use_managed_identity": {
+                    "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "azure_client_id": {
+                    "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                    "type": "string",
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "azure_client_secret": {
+                    "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "azure_tenant_id": {
+                    "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                    "type": "string",
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "gcp_use_service_account": {
+                    "description": "Use service account auth for GCP-based providers and models.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "gcp_service_account_json": {
+                    "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "aws_access_key_id": {
+                    "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "aws_secret_access_key": {
+                    "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "allow_override": {
+                    "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "model": {
+              "type": "record",
+              "fields": [
+                {
+                  "provider": {
+                    "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats.",
+                    "type": "string",
+                    "one_of": [
+                      "openai",
+                      "azure",
+                      "anthropic",
+                      "cohere",
+                      "mistral",
+                      "llama2",
+                      "gemini",
+                      "bedrock",
+                      "huggingface"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "name": {
+                    "description": "Model name to execute.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "options": {
+                    "description": "Key/value settings for the model",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "max_tokens": {
+                          "description": "Defines the max_tokens, if using chat or completion models.",
+                          "type": "integer",
+                          "required": false
+                        }
+                      },
+                      {
+                        "input_cost": {
+                          "description": "Defines the cost per 1M tokens in your prompt.",
+                          "type": "number",
+                          "gt": 0,
+                          "required": false
+                        }
+                      },
+                      {
+                        "output_cost": {
+                          "description": "Defines the cost per 1M tokens in the output of the AI.",
+                          "type": "number",
+                          "gt": 0,
+                          "required": false
+                        }
+                      },
+                      {
+                        "temperature": {
+                          "description": "Defines the matching temperature, if using chat or completion models.",
+                          "type": "number",
+                          "between": [
+                            0,
+                            5
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "top_p": {
+                          "description": "Defines the top-p probability mass, if supported.",
+                          "type": "number",
+                          "between": [
+                            0,
+                            1
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "top_k": {
+                          "description": "Defines the top-k most likely tokens, if supported.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            500
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "anthropic_version": {
+                          "description": "Defines the schema/API version, if using Anthropic provider.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_instance": {
+                          "description": "Instance name for Azure OpenAI hosted models.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_api_version": {
+                          "description": "'api-version' for Azure OpenAI instances.",
+                          "type": "string",
+                          "default": "2023-05-15",
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_deployment_id": {
+                          "description": "Deployment ID for Azure OpenAI instances.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "llama2_format": {
+                          "description": "If using llama2 provider, select the upstream message format.",
+                          "type": "string",
+                          "one_of": [
+                            "raw",
+                            "openai",
+                            "ollama"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "mistral_format": {
+                          "description": "If using mistral provider, select the upstream message format.",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "ollama"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "upstream_url": {
+                          "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "upstream_path": {
+                          "description": "Manually specify or override the AI operation path, used when e.g. using the 'preserve' route_type.",
+                          "type": "string",
+                          "deprecation": {
+                            "message": "llm: config.model.options.upstream_path is deprecated, please use config.model.options.upstream_url instead",
+                            "removal_in_version": "4.0"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "embeddings_dimensions": {
+                          "description": "If using embeddings models, set the number of dimensions to generate.",
+                          "type": "integer",
+                          "gt": 0,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gemini": {
+                          "entity_checks": [
+                            {
+                              "mutually_required": [
+                                "api_endpoint",
+                                "project_id",
+                                "location_id"
+                              ]
+                            }
+                          ],
+                          "type": "record",
+                          "fields": [
+                            {
+                              "api_endpoint": {
+                                "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "project_id": {
+                                "description": "If running Gemini on Vertex, specify the project ID.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "location_id": {
+                                "description": "If running Gemini on Vertex, specify the location ID.",
+                                "type": "string",
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "bedrock": {
+                          "entity_checks": [
+                            {
+                              "mutually_required": [
+                                "aws_assume_role_arn",
+                                "aws_role_session_name"
+                              ]
+                            }
+                          ],
+                          "type": "record",
+                          "fields": [
+                            {
+                              "aws_region": {
+                                "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "aws_assume_role_arn": {
+                                "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "aws_role_session_name": {
+                                "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                "type": "string"
+                              }
+                            },
+                            {
+                              "aws_sts_endpoint_url": {
+                                "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                "type": "string"
+                              }
+                            },
+                            {
+                              "embeddings_normalize": {
+                                "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                "type": "boolean",
+                                "default": false
+                              }
+                            },
+                            {
+                              "performance_config_latency": {
+                                "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                "type": "string",
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "huggingface": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "use_cache": {
+                                "description": "Use the cache layer on the inference API",
+                                "type": "boolean",
+                                "required": false
+                              }
+                            },
+                            {
+                              "wait_for_model": {
+                                "description": "Wait for the model if it is not ready",
+                                "type": "boolean",
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "cohere": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "embedding_input_type": {
+                                "description": "The purpose of the input text to calculate embedding vectors.",
+                                "type": "string",
+                                "one_of": [
+                                  "search_document",
+                                  "search_query",
+                                  "classification",
+                                  "clustering",
+                                  "image"
+                                ],
+                                "required": false,
+                                "default": "classification"
+                              }
+                            },
+                            {
+                              "wait_for_model": {
+                                "description": "Wait for the model if it is not ready",
+                                "type": "boolean",
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "logging": {
+              "type": "record",
+              "fields": [
+                {
+                  "log_statistics": {
+                    "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log plugin(s) output.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "log_payloads": {
+                    "description": "If enabled, will log the request and response body into the Kong log plugin(s) output.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "response_streaming": {
+              "description": "Whether to 'optionally allow', 'deny', or 'always' (force) the streaming of answers via server sent events.",
+              "type": "string",
+              "one_of": [
+                "allow",
+                "deny",
+                "always"
+              ],
+              "required": false,
+              "default": "allow"
+            }
+          },
+          {
+            "max_request_body_size": {
+              "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+              "type": "integer",
+              "gt": 0,
+              "default": 8192
+            }
+          },
+          {
+            "model_name_header": {
+              "description": "Display the model name selected in the X-Kong-LLM-Model response header",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "llm_format": {
+              "description": "LLM input and output format and schema to use",
+              "type": "string",
+              "one_of": [
+                "openai",
+                "bedrock",
+                "gemini",
+                "cohere",
+                "huggingface"
+              ],
+              "required": false,
+              "default": "openai"
+            }
+          },
+          {
+            "genai_category": {
+              "description": "Generative AI category of the request",
+              "type": "string",
+              "one_of": [
+                "text/generation",
+                "text/embeddings",
+                "audio/transcription",
+                "audio/speech",
+                "image/generation",
+                "video/generation"
+              ],
+              "default": "text/generation",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-rag-injector/3.12.json b/schemas/ai-rag-injector/3.12.json
new file mode 100644
index 00000000..146c8bd2
--- /dev/null
+++ b/schemas/ai-rag-injector/3.12.json
@@ -0,0 +1,959 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.inject_template"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "stop_on_failure": {
+              "description": "Halt the LLM request process in case of a vectordb or embeddings service failure",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "inject_as_role": {
+              "default": "user",
+              "type": "string",
+              "one_of": [
+                "system",
+                "assistant",
+                "user"
+              ],
+              "required": true
+            }
+          },
+          {
+            "inject_template": {
+              "type": "string",
+              "default": "<CONTEXT>\n<PROMPT>",
+              "required": true
+            }
+          },
+          {
+            "fetch_chunks_count": {
+              "description": "The maximum number of chunks to fetch from vectordb",
+              "type": "number",
+              "default": 5,
+              "required": true
+            }
+          },
+          {
+            "vectordb_namespace": {
+              "description": "The namespace of the vectordb to use for embeddings lookup",
+              "type": "string",
+              "default": "kong_rag_injector",
+              "required": true
+            }
+          },
+          {
+            "embeddings": {
+              "entity_checks": [
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.instance"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.api_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.deployment_id"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "auth": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "header_name": {
+                          "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "header_value": {
+                          "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_name": {
+                          "description": "If AI model requires authentication via query parameter, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_value": {
+                          "description": "Specify the full parameter value for 'param_name'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_location": {
+                          "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                          "type": "string",
+                          "one_of": [
+                            "query",
+                            "body"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_use_managed_identity": {
+                          "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "azure_client_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_secret": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_tenant_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_use_service_account": {
+                          "description": "Use service account auth for GCP-based providers and models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "gcp_service_account_json": {
+                          "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_access_key_id": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_secret_access_key": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "allow_override": {
+                          "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "model": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "provider": {
+                          "description": "AI provider format to use for embeddings API",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "mistral",
+                            "huggingface",
+                            "azure",
+                            "bedrock",
+                            "gemini"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "name": {
+                          "description": "Model name to execute.",
+                          "type": "string",
+                          "required": true
+                        }
+                      },
+                      {
+                        "options": {
+                          "description": "Key/value settings for the model",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "upstream_url": {
+                                "description": "upstream url for the embeddings",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "instance": {
+                                      "description": "Instance name for Azure OpenAI hosted models.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "api_version": {
+                                      "description": "'api-version' for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "required": false,
+                                      "default": "2023-05-15"
+                                    }
+                                  },
+                                  {
+                                    "deployment_id": {
+                                      "description": "Deployment ID for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": true
+                              }
+                            },
+                            {
+                              "bedrock": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "aws_assume_role_arn",
+                                      "aws_role_session_name"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "aws_region": {
+                                      "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_assume_role_arn": {
+                                      "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_role_session_name": {
+                                      "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "aws_sts_endpoint_url": {
+                                      "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "embeddings_normalize": {
+                                      "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                      "type": "boolean",
+                                      "default": false
+                                    }
+                                  },
+                                  {
+                                    "performance_config_latency": {
+                                      "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "gemini": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "api_endpoint",
+                                      "project_id",
+                                      "location_id"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "api_endpoint": {
+                                      "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "project_id": {
+                                      "description": "If running Gemini on Vertex, specify the project ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "location_id": {
+                                      "description": "If running Gemini on Vertex, specify the location ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "huggingface": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "use_cache": {
+                                      "description": "Use the cache layer on the inference API",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "vectordb": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "which vector database driver to use",
+                    "type": "string",
+                    "one_of": [
+                      "redis",
+                      "pgvector"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "dimensions": {
+                    "description": "the desired dimensionality for the vectors",
+                    "type": "integer",
+                    "required": true
+                  }
+                },
+                {
+                  "distance_metric": {
+                    "description": "the distance metric to use for vector searches",
+                    "type": "string",
+                    "one_of": [
+                      "cosine",
+                      "euclidean"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "redis": {
+                    "entity_checks": [
+                      {
+                        "mutually_required": [
+                          "host",
+                          "port"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "sentinel_master",
+                          "sentinel_role",
+                          "sentinel_nodes"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "connect_timeout",
+                          "send_timeout",
+                          "read_timeout"
+                        ]
+                      },
+                      {
+                        "conditional": {
+                          "then_field": "host",
+                          "if_match": {
+                            "eq": true
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "connection_is_proxied"
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "database",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "cluster_nodes",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "sentinel_role",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "shorthand_fields": [
+                      {
+                        "timeout": {
+                          "deprecation": {
+                            "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "connect_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "send_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "read_timeout"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "integer"
+                        }
+                      },
+                      {
+                        "sentinel_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "sentinel_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "cluster_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "cluster_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      }
+                    ],
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ],
+                          "default": 6379
+                        }
+                      },
+                      {
+                        "connect_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "send_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "read_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_username": {
+                          "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_password": {
+                          "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "Database to use for the Redis connection when using the `redis` strategy",
+                          "type": "integer",
+                          "default": 0
+                        }
+                      },
+                      {
+                        "keepalive_pool_size": {
+                          "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                          "type": "integer",
+                          "between": [
+                            1,
+                            2147483646
+                          ],
+                          "default": 256
+                        }
+                      },
+                      {
+                        "keepalive_backlog": {
+                          "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_master": {
+                          "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "sentinel_role": {
+                          "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                          "type": "string",
+                          "one_of": [
+                            "master",
+                            "slave",
+                            "any"
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_nodes": {
+                          "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "host": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "default": "127.0.0.1",
+                                  "required": true
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_nodes": {
+                          "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "ip": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "default": "127.0.0.1",
+                                  "required": true
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "If set to true, uses SSL to connect to Redis.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      },
+                      {
+                        "server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_max_redirections": {
+                          "description": "Maximum retry attempts for redirection.",
+                          "type": "integer",
+                          "required": false,
+                          "default": 5
+                        }
+                      },
+                      {
+                        "connection_is_proxied": {
+                          "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                          "type": "boolean",
+                          "default": false,
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "pgvector": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "the host of the pgvector database",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "the port of the pgvector database",
+                          "type": "integer",
+                          "default": 5432
+                        }
+                      },
+                      {
+                        "user": {
+                          "description": "the user of the pgvector database",
+                          "type": "string",
+                          "referenceable": true,
+                          "default": "postgres"
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "the password of the pgvector database",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "the database of the pgvector database",
+                          "type": "string",
+                          "default": "kong-pgvector"
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "the timeout of the pgvector database",
+                          "type": "number",
+                          "default": 5000
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "whether to use ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_required": {
+                          "description": "whether ssl is required for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "whether to verify ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_version": {
+                          "description": "the ssl version to use for the pgvector database",
+                          "type": "string",
+                          "one_of": [
+                            "tlsv1_2",
+                            "tlsv1_3",
+                            "any"
+                          ],
+                          "default": "tlsv1_2"
+                        }
+                      },
+                      {
+                        "ssl_cert": {
+                          "description": "the path of ssl cert to use for the pgvector database",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "ssl_cert_key": {
+                          "description": "the path of ssl cert key to use for the pgvector database",
+                          "type": "string"
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-rate-limiting-advanced/3.12.json b/schemas/ai-rate-limiting-advanced/3.12.json
new file mode 100644
index 00000000..d6350091
--- /dev/null
+++ b/schemas/ai-rate-limiting-advanced/3.12.json
@@ -0,0 +1,624 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "identifier": {
+              "description": "The type of identifier used to generate the rate limit key. Defines the scope used to increment the rate limiting counters. Can be `ip`, `credential`, `consumer`, `service`, `header`, `path` or `consumer-group`. Note if `identifier` is `consumer-group`, the plugin must be applied on a consumer group entity. Because a consumer may belong to multiple consumer groups, the plugin needs to know explicitly which consumer group to limit the rate.",
+              "type": "string",
+              "one_of": [
+                "ip",
+                "credential",
+                "consumer",
+                "service",
+                "header",
+                "path",
+                "consumer-group"
+              ],
+              "required": true,
+              "default": "consumer"
+            }
+          },
+          {
+            "window_type": {
+              "description": "Sets the time window type to either `sliding` (default) or `fixed`. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window's counters.",
+              "type": "string",
+              "one_of": [
+                "fixed",
+                "sliding"
+              ],
+              "default": "sliding"
+            }
+          },
+          {
+            "sync_rate": {
+              "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms).",
+              "type": "number"
+            }
+          },
+          {
+            "namespace": {
+              "description": "The rate limiting library namespace to use for this plugin instance. Counter data and sync configuration is isolated in each namespace. NOTE: For the plugin instances sharing the same namespace, all the configurations that are required for synchronizing counters, e.g. `strategy`, `redis`, `sync_rate`, `dictionary_name`, need to be the same.",
+              "type": "string"
+            }
+          },
+          {
+            "llm_providers": {
+              "description": "The provider config. Takes an array of `name`, `limit` and `window size` values.",
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "window_size": {
+                      "description": "One or more window sizes to apply a limit to (defined in seconds). There must be a matching number of window limits and sizes specified.",
+                      "type": "array",
+                      "elements": {
+                        "type": "number"
+                      },
+                      "required": true
+                    }
+                  },
+                  {
+                    "name": {
+                      "description": "The LLM provider to which the rate limit applies.",
+                      "type": "string",
+                      "one_of": [
+                        "openai",
+                        "azure",
+                        "anthropic",
+                        "cohere",
+                        "mistral",
+                        "llama2",
+                        "bedrock",
+                        "gemini",
+                        "huggingface",
+                        "requestPrompt"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "limit": {
+                      "description": "One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified.",
+                      "type": "array",
+                      "elements": {
+                        "type": "number"
+                      },
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "required": true
+            }
+          },
+          {
+            "strategy": {
+              "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local` and `cluster`.",
+              "type": "string",
+              "one_of": [
+                "cluster",
+                "redis",
+                "local"
+              ],
+              "required": true,
+              "default": "local"
+            }
+          },
+          {
+            "dictionary_name": {
+              "description": "The shared dictionary where counters are stored. When the plugin is configured to synchronize counter data externally (that is `config.strategy` is `cluster` or `redis` and `config.sync_rate` isn't `-1`), this dictionary serves as a buffer to populate counters in the data store on each synchronization cycle.",
+              "type": "string",
+              "default": "kong_rate_limiting_counters",
+              "required": true
+            }
+          },
+          {
+            "hide_client_headers": {
+              "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "retry_after_jitter_max": {
+              "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.",
+              "type": "number",
+              "default": 0
+            }
+          },
+          {
+            "header_name": {
+              "description": "A string representing an HTTP header name.",
+              "type": "string"
+            }
+          },
+          {
+            "path": {
+              "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).",
+              "type": "string",
+              "starts_with": "/",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ]
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "default": 5,
+                    "required": false
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "disable_penalty": {
+              "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type and the request prompt provider.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "request_prompt_count_function": {
+              "description": "If defined, it use custom function to count requests for the request prompt provider",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "error_code": {
+              "description": "Set a custom error code to return when the rate limit is exceeded.",
+              "type": "number",
+              "gt": 0,
+              "default": 429
+            }
+          },
+          {
+            "error_message": {
+              "description": "Set a custom error message to return when the rate limit is exceeded.",
+              "type": "string",
+              "default": "AI token rate limit exceeded for provider(s): "
+            }
+          },
+          {
+            "error_hide_providers": {
+              "description": "Optionally hide informative response that would otherwise provide information about the provider in the error message.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "tokens_count_strategy": {
+              "description": "What tokens to use for cost calculation. Available values are: `total_tokens` `prompt_tokens`, `completion_tokens` or `cost`.",
+              "type": "string",
+              "one_of": [
+                "total_tokens",
+                "prompt_tokens",
+                "completion_tokens",
+                "cost"
+              ],
+              "required": true,
+              "default": "total_tokens"
+            }
+          },
+          {
+            "llm_format": {
+              "description": "LLM input and output format and schema to use",
+              "type": "string",
+              "one_of": [
+                "openai",
+                "bedrock",
+                "gemini",
+                "cohere",
+                "huggingface"
+              ],
+              "required": false,
+              "default": "openai"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/ai-request-transformer/3.12.json b/schemas/ai-request-transformer/3.12.json
new file mode 100644
index 00000000..1418685b
--- /dev/null
+++ b/schemas/ai-request-transformer/3.12.json
@@ -0,0 +1,808 @@
+{
+  "entity_checks": [
+    {
+      "conditional": {
+        "then_field": "config.llm.route_type",
+        "then_err": "'config.llm.route_type' must be 'llm/v1/chat' for AI transformer plugins",
+        "then_match": {
+          "eq": "llm/v1/chat"
+        },
+        "if_match": {
+          "not_one_of": [
+            "llm/v1/chat"
+          ]
+        },
+        "if_field": "config.llm.route_type"
+      }
+    },
+    {
+      "mutually_required": [
+        "config.http_proxy_host",
+        "config.http_proxy_port"
+      ]
+    },
+    {
+      "mutually_required": [
+        "config.https_proxy_host",
+        "config.https_proxy_port"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "prompt": {
+              "description": "Use this prompt to tune the LLM system/assistant message for the incoming proxy request (from the client), and what you are expecting in return.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "transformation_extract_pattern": {
+              "description": "Defines the regular expression that must match to indicate a successful AI transformation at the request phase. The first match will be set as the outgoing body. If the AI service's response doesn't match this pattern, it is marked as a failure.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "http_timeout": {
+              "description": "Timeout in milliseconds for the AI upstream service.",
+              "type": "integer",
+              "required": true,
+              "default": 60000
+            }
+          },
+          {
+            "https_verify": {
+              "description": "Verify the TLS certificate of the AI upstream service.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "max_request_body_size": {
+              "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+              "type": "integer",
+              "gt": 0,
+              "default": 8192
+            }
+          },
+          {
+            "http_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "https_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "https_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "llm": {
+              "entity_checks": [
+                {
+                  "conditional": {
+                    "then_field": "auth.allow_override",
+                    "then_err": "bedrock and gemini only support auth.allow_override = false",
+                    "then_match": {
+                      "eq": false
+                    },
+                    "if_match": {
+                      "one_of": [
+                        "bedrock",
+                        "gemini"
+                      ]
+                    },
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "mutually_required": [
+                    "auth.header_name",
+                    "auth.header_value"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "auth.param_name",
+                    "auth.param_value",
+                    "auth.param_location"
+                  ]
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.llama2_format"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "llama2"
+                      ]
+                    },
+                    "then_err": "must set %s for llama2 provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.mistral_format"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "mistral"
+                      ]
+                    },
+                    "then_err": "must set %s for mistral provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.anthropic_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "anthropic"
+                      ]
+                    },
+                    "then_err": "must set %s for anthropic provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_instance"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_api_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_deployment_id"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.upstream_url"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "llama2"
+                      ]
+                    },
+                    "then_err": "must set %s for self-hosted providers/models",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model",
+                      "logging"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model"
+                    ]
+                  }
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "route_type": {
+                    "description": "The model's operation implementation, for this provider. ",
+                    "type": "string",
+                    "one_of": [
+                      "llm/v1/chat",
+                      "llm/v1/completions",
+                      "llm/v1/embeddings",
+                      "llm/v1/responses",
+                      "llm/v1/assistants",
+                      "llm/v1/batches",
+                      "llm/v1/files",
+                      "image/v1/images/generations",
+                      "image/v1/images/edits",
+                      "audio/v1/audio/transcriptions",
+                      "audio/v1/audio/speech",
+                      "audio/v1/audio/translations",
+                      "realtime/v1/realtime",
+                      "preserve"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "auth": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "header_name": {
+                          "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "header_value": {
+                          "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_name": {
+                          "description": "If AI model requires authentication via query parameter, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_value": {
+                          "description": "Specify the full parameter value for 'param_name'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_location": {
+                          "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                          "type": "string",
+                          "one_of": [
+                            "query",
+                            "body"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_use_managed_identity": {
+                          "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "azure_client_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_secret": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_tenant_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_use_service_account": {
+                          "description": "Use service account auth for GCP-based providers and models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "gcp_service_account_json": {
+                          "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_access_key_id": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_secret_access_key": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "allow_override": {
+                          "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "model": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "provider": {
+                          "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats.",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "azure",
+                            "anthropic",
+                            "cohere",
+                            "mistral",
+                            "llama2",
+                            "gemini",
+                            "bedrock",
+                            "huggingface"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "name": {
+                          "description": "Model name to execute.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "options": {
+                          "description": "Key/value settings for the model",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "max_tokens": {
+                                "description": "Defines the max_tokens, if using chat or completion models.",
+                                "type": "integer",
+                                "required": false
+                              }
+                            },
+                            {
+                              "input_cost": {
+                                "description": "Defines the cost per 1M tokens in your prompt.",
+                                "type": "number",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "output_cost": {
+                                "description": "Defines the cost per 1M tokens in the output of the AI.",
+                                "type": "number",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "temperature": {
+                                "description": "Defines the matching temperature, if using chat or completion models.",
+                                "type": "number",
+                                "between": [
+                                  0,
+                                  5
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "top_p": {
+                                "description": "Defines the top-p probability mass, if supported.",
+                                "type": "number",
+                                "between": [
+                                  0,
+                                  1
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "top_k": {
+                                "description": "Defines the top-k most likely tokens, if supported.",
+                                "type": "integer",
+                                "between": [
+                                  0,
+                                  500
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "anthropic_version": {
+                                "description": "Defines the schema/API version, if using Anthropic provider.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure_instance": {
+                                "description": "Instance name for Azure OpenAI hosted models.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure_api_version": {
+                                "description": "'api-version' for Azure OpenAI instances.",
+                                "type": "string",
+                                "required": false,
+                                "default": "2023-05-15"
+                              }
+                            },
+                            {
+                              "azure_deployment_id": {
+                                "description": "Deployment ID for Azure OpenAI instances.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "llama2_format": {
+                                "description": "If using llama2 provider, select the upstream message format.",
+                                "type": "string",
+                                "one_of": [
+                                  "raw",
+                                  "openai",
+                                  "ollama"
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "mistral_format": {
+                                "description": "If using mistral provider, select the upstream message format.",
+                                "type": "string",
+                                "one_of": [
+                                  "openai",
+                                  "ollama"
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "upstream_url": {
+                                "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "upstream_path": {
+                                "description": "Manually specify or override the AI operation path, used when e.g. using the 'preserve' route_type.",
+                                "type": "string",
+                                "required": false,
+                                "deprecation": {
+                                  "message": "llm: config.model.options.upstream_path is deprecated, please use config.model.options.upstream_url instead",
+                                  "removal_in_version": "4.0"
+                                }
+                              }
+                            },
+                            {
+                              "embeddings_dimensions": {
+                                "description": "If using embeddings models, set the number of dimensions to generate.",
+                                "type": "integer",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "gemini": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "api_endpoint",
+                                      "project_id",
+                                      "location_id"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "api_endpoint": {
+                                      "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "project_id": {
+                                      "description": "If running Gemini on Vertex, specify the project ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "location_id": {
+                                      "description": "If running Gemini on Vertex, specify the location ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "bedrock": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "aws_assume_role_arn",
+                                      "aws_role_session_name"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "aws_region": {
+                                      "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_assume_role_arn": {
+                                      "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_role_session_name": {
+                                      "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "aws_sts_endpoint_url": {
+                                      "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "embeddings_normalize": {
+                                      "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                      "type": "boolean",
+                                      "default": false
+                                    }
+                                  },
+                                  {
+                                    "performance_config_latency": {
+                                      "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "huggingface": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "use_cache": {
+                                      "description": "Use the cache layer on the inference API",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "cohere": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "embedding_input_type": {
+                                      "description": "The purpose of the input text to calculate embedding vectors.",
+                                      "type": "string",
+                                      "one_of": [
+                                        "search_document",
+                                        "search_query",
+                                        "classification",
+                                        "clustering",
+                                        "image"
+                                      ],
+                                      "default": "classification",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "logging": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "log_statistics": {
+                          "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log plugin(s) output.",
+                          "type": "boolean",
+                          "required": true,
+                          "default": false
+                        }
+                      },
+                      {
+                        "log_payloads": {
+                          "description": "If enabled, will log the request and response body into the Kong log plugin(s) output.",
+                          "type": "boolean",
+                          "required": true,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-response-transformer/3.12.json b/schemas/ai-response-transformer/3.12.json
new file mode 100644
index 00000000..0fc44c84
--- /dev/null
+++ b/schemas/ai-response-transformer/3.12.json
@@ -0,0 +1,808 @@
+{
+  "entity_checks": [
+    {
+      "conditional": {
+        "then_field": "config.llm.route_type",
+        "then_err": "'config.llm.route_type' must be 'llm/v1/chat' for AI transformer plugins",
+        "then_match": {
+          "eq": "llm/v1/chat"
+        },
+        "if_match": {
+          "not_one_of": [
+            "llm/v1/chat"
+          ]
+        },
+        "if_field": "config.llm.route_type"
+      }
+    },
+    {
+      "mutually_required": [
+        "config.http_proxy_host",
+        "config.http_proxy_port"
+      ]
+    },
+    {
+      "mutually_required": [
+        "config.https_proxy_host",
+        "config.https_proxy_port"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "prompt": {
+              "description": "Use this prompt to tune the LLM system/assistant message for the returning proxy response (from the upstream), adn what response format you are expecting.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "transformation_extract_pattern": {
+              "description": "Defines the regular expression that must match to indicate a successful AI transformation at the response phase. The first match will be set as the returning body. If the AI service's response doesn't match this pattern, a failure is returned to the client.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "parse_llm_response_json_instructions": {
+              "description": "Set true to read specific response format from the LLM, and accordingly set the status code / body / headers that proxy back to the client. You need to engineer your LLM prompt to return the correct format, see plugin docs 'Overview' page for usage instructions.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "http_timeout": {
+              "description": "Timeout in milliseconds for the AI upstream service.",
+              "type": "integer",
+              "default": 60000,
+              "required": true
+            }
+          },
+          {
+            "https_verify": {
+              "description": "Verify the TLS certificate of the AI upstream service.",
+              "type": "boolean",
+              "default": true,
+              "required": true
+            }
+          },
+          {
+            "max_request_body_size": {
+              "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+              "type": "integer",
+              "gt": 0,
+              "default": 8192
+            }
+          },
+          {
+            "http_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "https_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "https_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "llm": {
+              "entity_checks": [
+                {
+                  "conditional": {
+                    "then_field": "auth.allow_override",
+                    "then_err": "bedrock and gemini only support auth.allow_override = false",
+                    "then_match": {
+                      "eq": false
+                    },
+                    "if_match": {
+                      "one_of": [
+                        "bedrock",
+                        "gemini"
+                      ]
+                    },
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "mutually_required": [
+                    "auth.header_name",
+                    "auth.header_value"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "auth.param_name",
+                    "auth.param_value",
+                    "auth.param_location"
+                  ]
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.llama2_format"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "llama2"
+                      ]
+                    },
+                    "then_err": "must set %s for llama2 provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.mistral_format"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "mistral"
+                      ]
+                    },
+                    "then_err": "must set %s for mistral provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.anthropic_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "anthropic"
+                      ]
+                    },
+                    "then_err": "must set %s for anthropic provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_instance"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_api_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure_deployment_id"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.upstream_url"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "llama2"
+                      ]
+                    },
+                    "then_err": "must set %s for self-hosted providers/models",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model",
+                      "logging"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model"
+                    ]
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "route_type",
+                      "model"
+                    ]
+                  }
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "route_type": {
+                    "description": "The model's operation implementation, for this provider. ",
+                    "type": "string",
+                    "one_of": [
+                      "llm/v1/chat",
+                      "llm/v1/completions",
+                      "llm/v1/embeddings",
+                      "llm/v1/responses",
+                      "llm/v1/assistants",
+                      "llm/v1/batches",
+                      "llm/v1/files",
+                      "image/v1/images/generations",
+                      "image/v1/images/edits",
+                      "audio/v1/audio/transcriptions",
+                      "audio/v1/audio/speech",
+                      "audio/v1/audio/translations",
+                      "realtime/v1/realtime",
+                      "preserve"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "auth": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "header_name": {
+                          "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "header_value": {
+                          "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_name": {
+                          "description": "If AI model requires authentication via query parameter, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_value": {
+                          "description": "Specify the full parameter value for 'param_name'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_location": {
+                          "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                          "type": "string",
+                          "one_of": [
+                            "query",
+                            "body"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_use_managed_identity": {
+                          "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "azure_client_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_secret": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_tenant_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_use_service_account": {
+                          "description": "Use service account auth for GCP-based providers and models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "gcp_service_account_json": {
+                          "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_access_key_id": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_secret_access_key": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "allow_override": {
+                          "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "model": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "provider": {
+                          "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats.",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "azure",
+                            "anthropic",
+                            "cohere",
+                            "mistral",
+                            "llama2",
+                            "gemini",
+                            "bedrock",
+                            "huggingface"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "name": {
+                          "description": "Model name to execute.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "options": {
+                          "description": "Key/value settings for the model",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "max_tokens": {
+                                "description": "Defines the max_tokens, if using chat or completion models.",
+                                "type": "integer",
+                                "required": false
+                              }
+                            },
+                            {
+                              "input_cost": {
+                                "description": "Defines the cost per 1M tokens in your prompt.",
+                                "type": "number",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "output_cost": {
+                                "description": "Defines the cost per 1M tokens in the output of the AI.",
+                                "type": "number",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "temperature": {
+                                "description": "Defines the matching temperature, if using chat or completion models.",
+                                "type": "number",
+                                "between": [
+                                  0,
+                                  5
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "top_p": {
+                                "description": "Defines the top-p probability mass, if supported.",
+                                "type": "number",
+                                "between": [
+                                  0,
+                                  1
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "top_k": {
+                                "description": "Defines the top-k most likely tokens, if supported.",
+                                "type": "integer",
+                                "between": [
+                                  0,
+                                  500
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "anthropic_version": {
+                                "description": "Defines the schema/API version, if using Anthropic provider.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure_instance": {
+                                "description": "Instance name for Azure OpenAI hosted models.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure_api_version": {
+                                "description": "'api-version' for Azure OpenAI instances.",
+                                "type": "string",
+                                "required": false,
+                                "default": "2023-05-15"
+                              }
+                            },
+                            {
+                              "azure_deployment_id": {
+                                "description": "Deployment ID for Azure OpenAI instances.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "llama2_format": {
+                                "description": "If using llama2 provider, select the upstream message format.",
+                                "type": "string",
+                                "one_of": [
+                                  "raw",
+                                  "openai",
+                                  "ollama"
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "mistral_format": {
+                                "description": "If using mistral provider, select the upstream message format.",
+                                "type": "string",
+                                "one_of": [
+                                  "openai",
+                                  "ollama"
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "upstream_url": {
+                                "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint.",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "upstream_path": {
+                                "description": "Manually specify or override the AI operation path, used when e.g. using the 'preserve' route_type.",
+                                "type": "string",
+                                "required": false,
+                                "deprecation": {
+                                  "message": "llm: config.model.options.upstream_path is deprecated, please use config.model.options.upstream_url instead",
+                                  "removal_in_version": "4.0"
+                                }
+                              }
+                            },
+                            {
+                              "embeddings_dimensions": {
+                                "description": "If using embeddings models, set the number of dimensions to generate.",
+                                "type": "integer",
+                                "gt": 0,
+                                "required": false
+                              }
+                            },
+                            {
+                              "gemini": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "api_endpoint",
+                                      "project_id",
+                                      "location_id"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "api_endpoint": {
+                                      "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "project_id": {
+                                      "description": "If running Gemini on Vertex, specify the project ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "location_id": {
+                                      "description": "If running Gemini on Vertex, specify the location ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "bedrock": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "aws_assume_role_arn",
+                                      "aws_role_session_name"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "aws_region": {
+                                      "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_assume_role_arn": {
+                                      "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_role_session_name": {
+                                      "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "aws_sts_endpoint_url": {
+                                      "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "embeddings_normalize": {
+                                      "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                      "type": "boolean",
+                                      "default": false
+                                    }
+                                  },
+                                  {
+                                    "performance_config_latency": {
+                                      "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "huggingface": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "use_cache": {
+                                      "description": "Use the cache layer on the inference API",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "cohere": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "embedding_input_type": {
+                                      "description": "The purpose of the input text to calculate embedding vectors.",
+                                      "type": "string",
+                                      "one_of": [
+                                        "search_document",
+                                        "search_query",
+                                        "classification",
+                                        "clustering",
+                                        "image"
+                                      ],
+                                      "default": "classification",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "logging": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "log_statistics": {
+                          "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log plugin(s) output.",
+                          "type": "boolean",
+                          "required": true,
+                          "default": false
+                        }
+                      },
+                      {
+                        "log_payloads": {
+                          "description": "If enabled, will log the request and response body into the Kong log plugin(s) output.",
+                          "type": "boolean",
+                          "required": true,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-sanitizer/3.12.json b/schemas/ai-sanitizer/3.12.json
new file mode 100644
index 00000000..d95f95f8
--- /dev/null
+++ b/schemas/ai-sanitizer/3.12.json
@@ -0,0 +1,197 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "host": {
+              "description": "The host of the sanitizer",
+              "type": "string",
+              "required": true,
+              "default": "localhost"
+            }
+          },
+          {
+            "port": {
+              "description": "The port of the sanitizer",
+              "type": "number",
+              "required": true,
+              "default": 8080
+            }
+          },
+          {
+            "scheme": {
+              "description": "The protocol can be http and https",
+              "type": "string",
+              "required": true,
+              "default": "http"
+            }
+          },
+          {
+            "timeout": {
+              "description": "Connection timeout with the sanitizer",
+              "type": "number",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive_timeout": {
+              "description": "The keepalive timeout for the established http connnection",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "sanitization_mode": {
+              "description": "The sanitization mode to use for the request",
+              "type": "string",
+              "one_of": [
+                "INPUT",
+                "OUTPUT",
+                "BOTH"
+              ],
+              "default": "INPUT",
+              "required": true
+            }
+          },
+          {
+            "stop_on_error": {
+              "description": "Stop processing if an error occurs.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "anonymize": {
+              "description": "List of types to be anonymized",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "one_of": [
+                  "general",
+                  "phone",
+                  "email",
+                  "creditcard",
+                  "crypto",
+                  "date",
+                  "ssn",
+                  "ip",
+                  "nrp",
+                  "domain",
+                  "credentials",
+                  "url",
+                  "medical",
+                  "driverlicense",
+                  "passport",
+                  "bank",
+                  "nationalid",
+                  "custom",
+                  "all",
+                  "all_and_credentials"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "all_and_credentials"
+              ]
+            }
+          },
+          {
+            "recover_redacted": {
+              "description": "Whether to recover redacted data. This doesn't apply to the redacted output.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "block_if_detected": {
+              "description": "Whether to block requests containing PII data",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "redact_type": {
+              "description": "What value to be used to redacted to",
+              "type": "string",
+              "one_of": [
+                "placeholder",
+                "synthetic"
+              ],
+              "default": "placeholder"
+            }
+          },
+          {
+            "custom_patterns": {
+              "description": "List of custom patterns to be used for anonymization",
+              "type": "array",
+              "len_min": 1,
+              "elements": {
+                "fields": [
+                  {
+                    "name": {
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "regex": {
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "score": {
+                      "default": 0.5,
+                      "type": "number",
+                      "between": [
+                        0,
+                        1
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-semantic-cache/3.12.json b/schemas/ai-semantic-cache/3.12.json
new file mode 100644
index 00000000..6112ad59
--- /dev/null
+++ b/schemas/ai-semantic-cache/3.12.json
@@ -0,0 +1,994 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "message_countback": {
+              "description": "Number of messages in the chat history to Vectorize/Cache",
+              "type": "number",
+              "between": [
+                1,
+                1000
+              ],
+              "default": 1
+            }
+          },
+          {
+            "ignore_system_prompts": {
+              "description": "Ignore and discard any system prompts when Vectorizing the request",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "ignore_assistant_prompts": {
+              "description": "Ignore and discard any assistant prompts when Vectorizing the request",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "ignore_tool_prompts": {
+              "description": "Ignore and discard any tool prompts when Vectorizing the request",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "stop_on_failure": {
+              "description": "Halt the LLM request process in case of a caching system failure",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "TTL in seconds of cache entities. Must be a value greater than 0.",
+              "type": "integer",
+              "gt": 0,
+              "default": 300
+            }
+          },
+          {
+            "cache_control": {
+              "description": "When enabled, respect the Cache-Control behaviors defined in RFC7234.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "exact_caching": {
+              "description": "When enabled, a first check for exact query will be done. It will impact DB size",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "llm_format": {
+              "description": "LLM input and output format and schema to use",
+              "type": "string",
+              "one_of": [
+                "openai",
+                "bedrock",
+                "gemini",
+                "cohere",
+                "huggingface"
+              ],
+              "required": false,
+              "default": "openai"
+            }
+          },
+          {
+            "embeddings": {
+              "entity_checks": [
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.instance"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.api_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.deployment_id"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "auth": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "header_name": {
+                          "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "header_value": {
+                          "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_name": {
+                          "description": "If AI model requires authentication via query parameter, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_value": {
+                          "description": "Specify the full parameter value for 'param_name'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_location": {
+                          "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                          "type": "string",
+                          "one_of": [
+                            "query",
+                            "body"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_use_managed_identity": {
+                          "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "azure_client_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_secret": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_tenant_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_use_service_account": {
+                          "description": "Use service account auth for GCP-based providers and models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "gcp_service_account_json": {
+                          "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_access_key_id": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_secret_access_key": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "allow_override": {
+                          "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "model": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "provider": {
+                          "description": "AI provider format to use for embeddings API",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "mistral",
+                            "huggingface",
+                            "azure",
+                            "bedrock",
+                            "gemini"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "name": {
+                          "description": "Model name to execute.",
+                          "type": "string",
+                          "required": true
+                        }
+                      },
+                      {
+                        "options": {
+                          "description": "Key/value settings for the model",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "upstream_url": {
+                                "description": "upstream url for the embeddings",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "instance": {
+                                      "description": "Instance name for Azure OpenAI hosted models.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "api_version": {
+                                      "description": "'api-version' for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "required": false,
+                                      "default": "2023-05-15"
+                                    }
+                                  },
+                                  {
+                                    "deployment_id": {
+                                      "description": "Deployment ID for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": true
+                              }
+                            },
+                            {
+                              "bedrock": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "aws_assume_role_arn",
+                                      "aws_role_session_name"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "aws_region": {
+                                      "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_assume_role_arn": {
+                                      "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_role_session_name": {
+                                      "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "aws_sts_endpoint_url": {
+                                      "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "embeddings_normalize": {
+                                      "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                      "type": "boolean",
+                                      "default": false
+                                    }
+                                  },
+                                  {
+                                    "performance_config_latency": {
+                                      "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "gemini": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "api_endpoint",
+                                      "project_id",
+                                      "location_id"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "api_endpoint": {
+                                      "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "project_id": {
+                                      "description": "If running Gemini on Vertex, specify the project ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "location_id": {
+                                      "description": "If running Gemini on Vertex, specify the location ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "huggingface": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "use_cache": {
+                                      "description": "Use the cache layer on the inference API",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "vectordb": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "which vector database driver to use",
+                    "type": "string",
+                    "one_of": [
+                      "redis",
+                      "pgvector"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "dimensions": {
+                    "description": "the desired dimensionality for the vectors",
+                    "type": "integer",
+                    "required": true
+                  }
+                },
+                {
+                  "threshold": {
+                    "description": "the default similarity threshold for accepting semantic search results (float)",
+                    "type": "number",
+                    "required": true
+                  }
+                },
+                {
+                  "distance_metric": {
+                    "description": "the distance metric to use for vector searches",
+                    "type": "string",
+                    "one_of": [
+                      "cosine",
+                      "euclidean"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "redis": {
+                    "entity_checks": [
+                      {
+                        "mutually_required": [
+                          "host",
+                          "port"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "sentinel_master",
+                          "sentinel_role",
+                          "sentinel_nodes"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "connect_timeout",
+                          "send_timeout",
+                          "read_timeout"
+                        ]
+                      },
+                      {
+                        "conditional": {
+                          "then_field": "host",
+                          "if_match": {
+                            "eq": true
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "connection_is_proxied"
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "database",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "cluster_nodes",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "sentinel_role",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "shorthand_fields": [
+                      {
+                        "timeout": {
+                          "deprecation": {
+                            "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "connect_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "send_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "read_timeout"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "integer"
+                        }
+                      },
+                      {
+                        "sentinel_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "sentinel_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "cluster_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "cluster_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      }
+                    ],
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ],
+                          "default": 6379
+                        }
+                      },
+                      {
+                        "connect_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "send_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "read_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_username": {
+                          "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_password": {
+                          "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "Database to use for the Redis connection when using the `redis` strategy",
+                          "type": "integer",
+                          "default": 0
+                        }
+                      },
+                      {
+                        "keepalive_pool_size": {
+                          "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                          "type": "integer",
+                          "between": [
+                            1,
+                            2147483646
+                          ],
+                          "default": 256
+                        }
+                      },
+                      {
+                        "keepalive_backlog": {
+                          "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_master": {
+                          "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "sentinel_role": {
+                          "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                          "type": "string",
+                          "one_of": [
+                            "master",
+                            "slave",
+                            "any"
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_nodes": {
+                          "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "host": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_nodes": {
+                          "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "ip": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "If set to true, uses SSL to connect to Redis.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_max_redirections": {
+                          "description": "Maximum retry attempts for redirection.",
+                          "type": "integer",
+                          "default": 5,
+                          "required": false
+                        }
+                      },
+                      {
+                        "connection_is_proxied": {
+                          "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "pgvector": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "the host of the pgvector database",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "the port of the pgvector database",
+                          "type": "integer",
+                          "default": 5432
+                        }
+                      },
+                      {
+                        "user": {
+                          "description": "the user of the pgvector database",
+                          "type": "string",
+                          "referenceable": true,
+                          "default": "postgres"
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "the password of the pgvector database",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "the database of the pgvector database",
+                          "type": "string",
+                          "default": "kong-pgvector"
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "the timeout of the pgvector database",
+                          "type": "number",
+                          "default": 5000
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "whether to use ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_required": {
+                          "description": "whether ssl is required for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "whether to verify ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_version": {
+                          "description": "the ssl version to use for the pgvector database",
+                          "type": "string",
+                          "one_of": [
+                            "tlsv1_2",
+                            "tlsv1_3",
+                            "any"
+                          ],
+                          "default": "tlsv1_2"
+                        }
+                      },
+                      {
+                        "ssl_cert": {
+                          "description": "the path of ssl cert to use for the pgvector database",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "ssl_cert_key": {
+                          "description": "the path of ssl cert key to use for the pgvector database",
+                          "type": "string"
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ai-semantic-prompt-guard/3.12.json b/schemas/ai-semantic-prompt-guard/3.12.json
new file mode 100644
index 00000000..0053fcf1
--- /dev/null
+++ b/schemas/ai-semantic-prompt-guard/3.12.json
@@ -0,0 +1,1028 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.rules.allow_prompts",
+        "config.rules.deny_prompts"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "embeddings": {
+              "entity_checks": [
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.instance"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.api_version"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                },
+                {
+                  "conditional_at_least_one_of": {
+                    "then_at_least_one_of": [
+                      "model.options.azure.deployment_id"
+                    ],
+                    "if_match": {
+                      "one_of": [
+                        "azure"
+                      ]
+                    },
+                    "then_err": "must set %s for azure provider",
+                    "if_field": "model.provider"
+                  }
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "auth": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "header_name": {
+                          "description": "If AI model requires authentication via Authorization or API key header, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "header_value": {
+                          "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_name": {
+                          "description": "If AI model requires authentication via query parameter, specify its name here.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_value": {
+                          "description": "Specify the full parameter value for 'param_name'.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "param_location": {
+                          "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body.",
+                          "type": "string",
+                          "one_of": [
+                            "query",
+                            "body"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_use_managed_identity": {
+                          "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "azure_client_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_client_secret": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "azure_tenant_id": {
+                          "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "gcp_use_service_account": {
+                          "description": "Use service account auth for GCP-based providers and models.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "gcp_service_account_json": {
+                          "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_access_key_id": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "aws_secret_access_key": {
+                          "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this plugin instance.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "allow_override": {
+                          "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the plugin.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "model": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "provider": {
+                          "description": "AI provider format to use for embeddings API",
+                          "type": "string",
+                          "one_of": [
+                            "openai",
+                            "mistral",
+                            "huggingface",
+                            "azure",
+                            "bedrock",
+                            "gemini"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "name": {
+                          "description": "Model name to execute.",
+                          "type": "string",
+                          "required": true
+                        }
+                      },
+                      {
+                        "options": {
+                          "description": "Key/value settings for the model",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "upstream_url": {
+                                "description": "upstream url for the embeddings",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "azure": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "instance": {
+                                      "description": "Instance name for Azure OpenAI hosted models.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "api_version": {
+                                      "description": "'api-version' for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "required": false,
+                                      "default": "2023-05-15"
+                                    }
+                                  },
+                                  {
+                                    "deployment_id": {
+                                      "description": "Deployment ID for Azure OpenAI instances.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": true
+                              }
+                            },
+                            {
+                              "bedrock": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "aws_assume_role_arn",
+                                      "aws_role_session_name"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "aws_region": {
+                                      "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_assume_role_arn": {
+                                      "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "aws_role_session_name": {
+                                      "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "aws_sts_endpoint_url": {
+                                      "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role.",
+                                      "type": "string"
+                                    }
+                                  },
+                                  {
+                                    "embeddings_normalize": {
+                                      "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.",
+                                      "type": "boolean",
+                                      "default": false
+                                    }
+                                  },
+                                  {
+                                    "performance_config_latency": {
+                                      "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "gemini": {
+                                "entity_checks": [
+                                  {
+                                    "mutually_required": [
+                                      "api_endpoint",
+                                      "project_id",
+                                      "location_id"
+                                    ]
+                                  }
+                                ],
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "api_endpoint": {
+                                      "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only).",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "project_id": {
+                                      "description": "If running Gemini on Vertex, specify the project ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "location_id": {
+                                      "description": "If running Gemini on Vertex, specify the location ID.",
+                                      "type": "string",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            },
+                            {
+                              "huggingface": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "use_cache": {
+                                      "description": "Use the cache layer on the inference API",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  },
+                                  {
+                                    "wait_for_model": {
+                                      "description": "Wait for the model if it is not ready",
+                                      "type": "boolean",
+                                      "required": false
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "vectordb": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "which vector database driver to use",
+                    "type": "string",
+                    "one_of": [
+                      "redis",
+                      "pgvector"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "dimensions": {
+                    "description": "the desired dimensionality for the vectors",
+                    "type": "integer",
+                    "required": true
+                  }
+                },
+                {
+                  "threshold": {
+                    "description": "the default similarity threshold for accepting semantic search results (float)",
+                    "type": "number",
+                    "required": true
+                  }
+                },
+                {
+                  "distance_metric": {
+                    "description": "the distance metric to use for vector searches",
+                    "type": "string",
+                    "one_of": [
+                      "cosine",
+                      "euclidean"
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "redis": {
+                    "entity_checks": [
+                      {
+                        "mutually_required": [
+                          "host",
+                          "port"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "sentinel_master",
+                          "sentinel_role",
+                          "sentinel_nodes"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "connect_timeout",
+                          "send_timeout",
+                          "read_timeout"
+                        ]
+                      },
+                      {
+                        "conditional": {
+                          "then_field": "host",
+                          "if_match": {
+                            "eq": true
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "connection_is_proxied"
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "database",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "cluster_nodes",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "sentinel_role",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "shorthand_fields": [
+                      {
+                        "timeout": {
+                          "deprecation": {
+                            "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "connect_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "send_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "read_timeout"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "integer"
+                        }
+                      },
+                      {
+                        "sentinel_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "sentinel_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "cluster_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "cluster_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      }
+                    ],
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ],
+                          "default": 6379
+                        }
+                      },
+                      {
+                        "connect_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "send_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "read_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_username": {
+                          "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_password": {
+                          "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "Database to use for the Redis connection when using the `redis` strategy",
+                          "type": "integer",
+                          "default": 0
+                        }
+                      },
+                      {
+                        "keepalive_pool_size": {
+                          "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                          "type": "integer",
+                          "between": [
+                            1,
+                            2147483646
+                          ],
+                          "default": 256
+                        }
+                      },
+                      {
+                        "keepalive_backlog": {
+                          "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_master": {
+                          "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "sentinel_role": {
+                          "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                          "type": "string",
+                          "one_of": [
+                            "master",
+                            "slave",
+                            "any"
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_nodes": {
+                          "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "host": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_nodes": {
+                          "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "ip": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "If set to true, uses SSL to connect to Redis.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_max_redirections": {
+                          "description": "Maximum retry attempts for redirection.",
+                          "type": "integer",
+                          "default": 5,
+                          "required": false
+                        }
+                      },
+                      {
+                        "connection_is_proxied": {
+                          "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "pgvector": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "the host of the pgvector database",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "the port of the pgvector database",
+                          "type": "integer",
+                          "default": 5432
+                        }
+                      },
+                      {
+                        "user": {
+                          "description": "the user of the pgvector database",
+                          "type": "string",
+                          "referenceable": true,
+                          "default": "postgres"
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "the password of the pgvector database",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "the database of the pgvector database",
+                          "type": "string",
+                          "default": "kong-pgvector"
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "the timeout of the pgvector database",
+                          "type": "number",
+                          "default": 5000
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "whether to use ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_required": {
+                          "description": "whether ssl is required for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "whether to verify ssl for the pgvector database",
+                          "type": "boolean",
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_version": {
+                          "description": "the ssl version to use for the pgvector database",
+                          "type": "string",
+                          "one_of": [
+                            "tlsv1_2",
+                            "tlsv1_3",
+                            "any"
+                          ],
+                          "default": "tlsv1_2"
+                        }
+                      },
+                      {
+                        "ssl_cert": {
+                          "description": "the path of ssl cert to use for the pgvector database",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "ssl_cert_key": {
+                          "description": "the path of ssl cert key to use for the pgvector database",
+                          "type": "string"
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "search": {
+              "type": "record",
+              "fields": [
+                {
+                  "threshold": {
+                    "description": "Threshold for the similarity score to be considered a match.",
+                    "type": "number",
+                    "default": 0.5,
+                    "required": false
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "rules": {
+              "type": "record",
+              "fields": [
+                {
+                  "match_all_conversation_history": {
+                    "description": "If false, will ignore all previous chat prompts from the conversation history.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "allow_prompts": {
+                    "description": "List of prompts to allow.",
+                    "type": "array",
+                    "len_max": 100,
+                    "elements": {
+                      "type": "string",
+                      "len_max": 500,
+                      "len_min": 1
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "deny_prompts": {
+                    "description": "List of prompts to deny.",
+                    "type": "array",
+                    "len_max": 100,
+                    "elements": {
+                      "type": "string",
+                      "len_max": 500,
+                      "len_min": 1
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "max_request_body_size": {
+                    "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.",
+                    "type": "integer",
+                    "gt": 0,
+                    "default": 8192
+                  }
+                },
+                {
+                  "match_all_roles": {
+                    "description": "If true, will match all roles in addition to 'user' role in conversation history.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "llm_format": {
+              "description": "LLM input and output format and schema to use",
+              "type": "string",
+              "one_of": [
+                "openai",
+                "bedrock",
+                "gemini",
+                "cohere",
+                "huggingface"
+              ],
+              "required": false,
+              "default": "openai"
+            }
+          },
+          {
+            "genai_category": {
+              "description": "Generative AI category of the request",
+              "type": "string",
+              "one_of": [
+                "text/generation",
+                "text/embeddings",
+                "audio/transcription",
+                "audio/speech",
+                "image/generation",
+                "video/generation",
+                "realtime/generation"
+              ],
+              "required": false,
+              "default": "text/generation"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/app-dynamics/3.12.json b/schemas/app-dynamics/3.12.json
new file mode 100644
index 00000000..f87203eb
--- /dev/null
+++ b/schemas/app-dynamics/3.12.json
@@ -0,0 +1,42 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/aws-lambda/3.12.json b/schemas/aws-lambda/3.12.json
new file mode 100644
index 00000000..a7b65d9c
--- /dev/null
+++ b/schemas/aws-lambda/3.12.json
@@ -0,0 +1,273 @@
+{
+  "entity_checks": [
+    {
+      "mutually_required": [
+        "config.aws_key",
+        "config.aws_secret"
+      ]
+    },
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.proxy_url"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "timeout": {
+              "description": "An optional timeout in milliseconds when invoking the function.",
+              "type": "number",
+              "required": true,
+              "default": 60000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "An optional value in milliseconds that defines how long an idle connection lives before being closed.",
+              "type": "number",
+              "required": true,
+              "default": 60000
+            }
+          },
+          {
+            "aws_key": {
+              "description": "The AWS key credential to be used when invoking the function.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "aws_secret": {
+              "description": "The AWS secret credential to be used when invoking the function. ",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "aws_assume_role_arn": {
+              "description": "The target AWS IAM role ARN used to invoke the Lambda function.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "aws_role_session_name": {
+              "description": "The identifier of the assumed role session.",
+              "type": "string",
+              "default": "kong"
+            }
+          },
+          {
+            "aws_sts_endpoint_url": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "type": "string"
+            }
+          },
+          {
+            "aws_region": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "function_name": {
+              "description": "The AWS Lambda function to invoke. Both function name and function ARN (including partial) are supported.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "qualifier": {
+              "description": "The qualifier to use when invoking the function.",
+              "type": "string"
+            }
+          },
+          {
+            "invocation_type": {
+              "description": "The InvocationType to use when invoking the function. Available types are RequestResponse, Event, DryRun.",
+              "type": "string",
+              "one_of": [
+                "RequestResponse",
+                "Event",
+                "DryRun"
+              ],
+              "default": "RequestResponse",
+              "required": true
+            }
+          },
+          {
+            "log_type": {
+              "description": "The LogType to use when invoking the function. By default, None and Tail are supported.",
+              "type": "string",
+              "one_of": [
+                "Tail",
+                "None"
+              ],
+              "default": "Tail",
+              "required": true
+            }
+          },
+          {
+            "host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ],
+              "default": 443
+            }
+          },
+          {
+            "disable_https": {
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "unhandled_status": {
+              "description": "The response status code to use (instead of the default 200, 202, or 204) in the case of an Unhandled Function Error.",
+              "type": "integer",
+              "between": [
+                100,
+                999
+              ]
+            }
+          },
+          {
+            "forward_request_method": {
+              "description": "An optional value that defines whether the original HTTP request method verb is sent in the request_method field of the JSON-encoded request.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_request_uri": {
+              "description": "An optional value that defines whether the original HTTP request URI is sent in the request_uri field of the JSON-encoded request.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_request_headers": {
+              "description": "An optional value that defines whether the original HTTP request headers are sent as a map in the request_headers field of the JSON-encoded request.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_request_body": {
+              "description": "An optional value that defines whether the request body is sent in the request_body field of the JSON-encoded request. If the body arguments can be parsed, they are sent in the separate request_body_args field of the request. ",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "is_proxy_integration": {
+              "description": "An optional value that defines whether the response format to receive from the Lambda to this format.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "awsgateway_compatible": {
+              "description": "An optional value that defines whether the plugin should wrap requests into the Amazon API gateway.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "proxy_url": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "type": "string"
+            }
+          },
+          {
+            "skip_large_bodies": {
+              "description": "An optional value that defines whether Kong should send large bodies that are buffered to disk",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "base64_encode_body": {
+              "description": "An optional value that Base64-encodes the request body.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "aws_imds_protocol_version": {
+              "description": "Identifier to select the IMDS protocol version to use: `v1` or `v2`.",
+              "type": "string",
+              "one_of": [
+                "v1",
+                "v2"
+              ],
+              "default": "v1",
+              "required": true
+            }
+          },
+          {
+            "empty_arrays_mode": {
+              "description": "An optional value that defines whether Kong should send empty arrays (returned by Lambda function) as `[]` arrays or `{}` objects in JSON responses. The value `legacy` means Kong will send empty arrays as `{}` objects in response",
+              "type": "string",
+              "one_of": [
+                "legacy",
+                "correct"
+              ],
+              "default": "legacy",
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/azure-functions/3.12.json b/schemas/azure-functions/3.12.json
new file mode 100644
index 00000000..281b570b
--- /dev/null
+++ b/schemas/azure-functions/3.12.json
@@ -0,0 +1,123 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "timeout": {
+              "description": "Timeout in milliseconds before closing a connection to the Azure Functions server.",
+              "type": "number",
+              "default": 600000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "Time in milliseconds during which an idle connection to the Azure Functions server lives before being closed.",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "https": {
+              "description": "Use of HTTPS to connect with the Azure Functions server.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "https_verify": {
+              "description": "Set to `true` to authenticate the Azure Functions server.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "apikey": {
+              "description": "The apikey to access the Azure resources. If provided, it is injected as the `x-functions-key` header.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "clientid": {
+              "description": "The `clientid` to access the Azure resources. If provided, it is injected as the `x-functions-clientid` header.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "appname": {
+              "description": "The Azure app name.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "hostdomain": {
+              "description": "The domain where the function resides.",
+              "type": "string",
+              "default": "azurewebsites.net",
+              "required": true
+            }
+          },
+          {
+            "routeprefix": {
+              "description": "Route prefix to use.",
+              "type": "string",
+              "default": "api"
+            }
+          },
+          {
+            "functionname": {
+              "description": "Name of the Azure function to invoke.",
+              "type": "string",
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/basic-auth/3.12.json b/schemas/basic-auth/3.12.json
new file mode 100644
index 00000000..bf34569a
--- /dev/null
+++ b/schemas/basic-auth/3.12.json
@@ -0,0 +1,76 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "anonymous": {
+              "description": "An optional string (Consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`. Please note that this value must refer to the Consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string"
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to show or hide the credential from the upstream service. If `true`, the plugin will strip the credential from the request (i.e. the `Authorization` header) before proxying it.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": true,
+              "default": "service"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/bot-detection/3.12.json b/schemas/bot-detection/3.12.json
new file mode 100644
index 00000000..2d2abee6
--- /dev/null
+++ b/schemas/bot-detection/3.12.json
@@ -0,0 +1,73 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "allow": {
+              "description": "An array of regular expressions that should be allowed. The regular expressions will be checked against the `User-Agent` header.",
+              "type": "array",
+              "elements": {
+                "is_regex": true,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "deny": {
+              "description": "An array of regular expressions that should be denied. The regular expressions will be checked against the `User-Agent` header.",
+              "type": "array",
+              "elements": {
+                "is_regex": true,
+                "type": "string"
+              },
+              "default": []
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/canary/3.12.json b/schemas/canary/3.12.json
new file mode 100644
index 00000000..9368dbc3
--- /dev/null
+++ b/schemas/canary/3.12.json
@@ -0,0 +1,190 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.upstream_uri",
+        "config.upstream_host",
+        "config.upstream_port"
+      ]
+    },
+    {
+      "conditional": {
+        "then_field": "config.hash_header",
+        "if_match": {
+          "eq": "header"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.hash"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.upstream_host",
+        "if_match": {
+          "eq": true
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.upstream_fallback"
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "required": true,
+        "type": "record",
+        "fields": [
+          {
+            "start": {
+              "description": "Future time in seconds since epoch, when the canary release will start. Ignored when `percentage` is set, or when using `allow` or `deny` in `hash`.",
+              "type": "number"
+            }
+          },
+          {
+            "hash": {
+              "description": "Hash algorithm to be used for canary release.\n\n* `consumer`: The hash will be based on the consumer.\n* `ip`: The hash will be based on the client IP address.\n* `none`: No hash will be applied.\n* `allow`: Allows the specified groups to access the canary release.\n* `deny`: Denies the specified groups from accessing the canary release.\n* `header`: The hash will be based on the specified header value.",
+              "type": "string",
+              "one_of": [
+                "consumer",
+                "ip",
+                "none",
+                "allow",
+                "deny",
+                "header"
+              ],
+              "default": "consumer"
+            }
+          },
+          {
+            "hash_header": {
+              "description": "A string representing an HTTP header name.",
+              "type": "string"
+            }
+          },
+          {
+            "duration": {
+              "description": "The duration of the canary release in seconds.",
+              "type": "number",
+              "gt": 0,
+              "default": 3600
+            }
+          },
+          {
+            "steps": {
+              "description": "The number of steps for the canary release.",
+              "type": "number",
+              "gt": 1,
+              "default": 1000
+            }
+          },
+          {
+            "percentage": {
+              "description": "The percentage of traffic to be routed to the canary release.",
+              "type": "number",
+              "between": [
+                0,
+                100
+              ]
+            }
+          },
+          {
+            "upstream_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "upstream_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "upstream_uri": {
+              "description": "The URI of the upstream server to be used for the canary release.",
+              "len_min": 1,
+              "type": "string"
+            }
+          },
+          {
+            "upstream_fallback": {
+              "description": "Specifies whether to fallback to the upstream server if the canary release fails.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "groups": {
+              "description": "The groups allowed to access the canary release.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "canary_by_header_name": {
+              "description": "A string representing an HTTP header name.",
+              "type": "string"
+            }
+          }
+        ],
+        "shorthand_fields": [
+          {
+            "hash": {
+              "description": "Hash algorithm to be used for canary release. `whitelist` is deprecated. Use `allow` instead `blacklist` is deprecated. Use `deny` instead.",
+              "type": "string"
+            }
+          }
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/confluent-consume/3.12.json b/schemas/confluent-consume/3.12.json
new file mode 100644
index 00000000..33aeb401
--- /dev/null
+++ b/schemas/confluent-consume/3.12.json
@@ -0,0 +1,402 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [],
+        "type": "record",
+        "fields": [
+          {
+            "bootstrap_servers": {
+              "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format.",
+              "type": "set",
+              "elements": {
+                "fields": [
+                  {
+                    "host": {
+                      "description": "A string representing a host name, such as example.com.",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "port": {
+                      "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                      "type": "integer",
+                      "between": [
+                        0,
+                        65535
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              }
+            }
+          },
+          {
+            "topics": {
+              "description": "The Kafka topics and their configuration you want to consume from.",
+              "type": "array",
+              "len_min": 1,
+              "elements": {
+                "fields": [
+                  {
+                    "name": {
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "schema_registry": {
+                      "description": "The plugin-global schema registry configuration.",
+                      "type": "record",
+                      "fields": [
+                        {
+                          "confluent": {
+                            "type": "record",
+                            "fields": [
+                              {
+                                "url": {
+                                  "description": "The URL of the schema registry.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "ttl": {
+                                  "description": "The TTL in seconds for the schema registry cache.",
+                                  "type": "number",
+                                  "between": [
+                                    0,
+                                    3600
+                                  ]
+                                }
+                              },
+                              {
+                                "ssl_verify": {
+                                  "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.",
+                                  "type": "boolean",
+                                  "default": true
+                                }
+                              },
+                              {
+                                "authentication": {
+                                  "entity_checks": [
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "mode",
+                                          "basic"
+                                        ]
+                                      }
+                                    }
+                                  ],
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "mode": {
+                                        "description": "Authentication mode to use with the schema registry.",
+                                        "type": "string",
+                                        "one_of": [
+                                          "none",
+                                          "basic"
+                                        ],
+                                        "required": true,
+                                        "default": "none"
+                                      }
+                                    },
+                                    {
+                                      "basic": {
+                                        "type": "record",
+                                        "fields": [
+                                          {
+                                            "username": {
+                                              "type": "string",
+                                              "referenceable": true,
+                                              "encrypted": true,
+                                              "required": true
+                                            }
+                                          },
+                                          {
+                                            "password": {
+                                              "type": "string",
+                                              "referenceable": true,
+                                              "encrypted": true,
+                                              "required": true
+                                            }
+                                          }
+                                        ],
+                                        "required": false
+                                      }
+                                    }
+                                  ],
+                                  "required": true
+                                }
+                              }
+                            ],
+                            "required": false
+                          }
+                        }
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "required": true
+            }
+          },
+          {
+            "schema_registry": {
+              "description": "The plugin-global schema registry configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "confluent": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "url": {
+                          "description": "The URL of the schema registry.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "ttl": {
+                          "description": "The TTL in seconds for the schema registry cache.",
+                          "type": "number",
+                          "between": [
+                            0,
+                            3600
+                          ]
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "authentication": {
+                          "entity_checks": [
+                            {
+                              "custom_entity_check": {
+                                "field_sources": [
+                                  "mode",
+                                  "basic"
+                                ]
+                              }
+                            }
+                          ],
+                          "type": "record",
+                          "fields": [
+                            {
+                              "mode": {
+                                "description": "Authentication mode to use with the schema registry.",
+                                "type": "string",
+                                "one_of": [
+                                  "none",
+                                  "basic"
+                                ],
+                                "required": true,
+                                "default": "none"
+                              }
+                            },
+                            {
+                              "basic": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "username": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  },
+                                  {
+                                    "password": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "mode": {
+              "description": "The mode of operation for the plugin.",
+              "type": "string",
+              "one_of": [
+                "server-sent-events",
+                "http-get"
+              ],
+              "default": "http-get",
+              "required": true
+            }
+          },
+          {
+            "message_deserializer": {
+              "description": "The deserializer to use for the consumed messages.",
+              "type": "string",
+              "one_of": [
+                "json",
+                "noop"
+              ],
+              "default": "noop",
+              "required": true
+            }
+          },
+          {
+            "auto_offset_reset": {
+              "description": "The offset to start from when there is no initial offset in the consumer group.",
+              "type": "string",
+              "one_of": [
+                "earliest",
+                "latest"
+              ],
+              "default": "latest",
+              "required": true
+            }
+          },
+          {
+            "commit_strategy": {
+              "description": "The strategy to use for committing offsets.",
+              "type": "string",
+              "one_of": [
+                "auto",
+                "off"
+              ],
+              "default": "auto",
+              "required": true
+            }
+          },
+          {
+            "timeout": {
+              "description": "Socket timeout in milliseconds.",
+              "type": "integer",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "Keepalive timeout in milliseconds.",
+              "type": "integer",
+              "default": 60000
+            }
+          },
+          {
+            "keepalive_enabled": {
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "cluster_api_key": {
+              "description": "Username/Apikey for SASL authentication.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "cluster_api_secret": {
+              "description": "Password/ApiSecret for SASL authentication.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "confluent_cloud_api_key": {
+              "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "confluent_cloud_api_secret": {
+              "description": "The corresponding secret for the Confluent Cloud API key.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "cluster_name": {
+              "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier.  If more than one Kafka plugin is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these plugins will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster.",
+              "auto": true,
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/confluent/3.12.json b/schemas/confluent/3.12.json
new file mode 100644
index 00000000..f602e7bd
--- /dev/null
+++ b/schemas/confluent/3.12.json
@@ -0,0 +1,446 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "forward_method",
+                "forward_uri",
+                "forward_headers",
+                "forward_body"
+              ]
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "bootstrap_servers": {
+              "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format.",
+              "type": "set",
+              "elements": {
+                "fields": [
+                  {
+                    "host": {
+                      "description": "A string representing a host name, such as example.com.",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "port": {
+                      "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                      "type": "integer",
+                      "between": [
+                        0,
+                        65535
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              }
+            }
+          },
+          {
+            "schema_registry": {
+              "description": "The plugin-global schema registry configuration. This can be overwritten by the topic configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "confluent": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "url": {
+                          "description": "The URL of the schema registry.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "ttl": {
+                          "description": "The TTL in seconds for the schema registry cache.",
+                          "type": "number",
+                          "between": [
+                            0,
+                            3600
+                          ]
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "authentication": {
+                          "entity_checks": [
+                            {
+                              "custom_entity_check": {
+                                "field_sources": [
+                                  "mode",
+                                  "basic"
+                                ]
+                              }
+                            }
+                          ],
+                          "type": "record",
+                          "fields": [
+                            {
+                              "mode": {
+                                "description": "Authentication mode to use with the schema registry.",
+                                "type": "string",
+                                "one_of": [
+                                  "none",
+                                  "basic"
+                                ],
+                                "required": true,
+                                "default": "none"
+                              }
+                            },
+                            {
+                              "basic": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "username": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  },
+                                  {
+                                    "password": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "value_schema": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "subject_name": {
+                                "description": "The name of the subject",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "schema_version": {
+                                "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version.",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be either 'latest' or a positive integer",
+                                  "patterns": [
+                                    "^latest$",
+                                    "^[0-9]+$"
+                                  ]
+                                },
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "key_schema": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "subject_name": {
+                                "description": "The name of the subject",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "schema_version": {
+                                "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version.",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be either 'latest' or a positive integer",
+                                  "patterns": [
+                                    "^latest$",
+                                    "^[0-9]+$"
+                                  ]
+                                },
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "topics_query_arg": {
+              "description": "The request query parameter name that contains the topics to publish to",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "allowed_topics": {
+              "description": "The list of allowed topic names to which messages can be sent. The default topic configured in the `topic` field is always allowed, regardless of its inclusion in `allowed_topics`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "topic": {
+              "description": "The default Kafka topic to publish to if the query parameter defined in the `topics_query_arg` does not exist in the request",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "key_query_arg": {
+              "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "timeout": {
+              "description": "Socket timeout in milliseconds.",
+              "type": "integer",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "Keepalive timeout in milliseconds.",
+              "type": "integer",
+              "default": 60000
+            }
+          },
+          {
+            "keepalive_enabled": {
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "cluster_api_key": {
+              "description": "Username/Apikey for SASL authentication.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "cluster_api_secret": {
+              "description": "Password/ApiSecret for SASL authentication.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "confluent_cloud_api_key": {
+              "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "confluent_cloud_api_secret": {
+              "description": "The corresponding secret for the Confluent Cloud API key.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "forward_method": {
+              "description": "Include the request method in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_uri": {
+              "description": "Include the request URI and URI arguments (as in, query arguments) in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_headers": {
+              "description": "Include the request headers in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_body": {
+              "description": "Include the request body in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "message_by_lua_functions": {
+              "description": "The Lua functions that manipulates the message being sent to the Kafka topic.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "cluster_name": {
+              "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier.  If more than one Kafka plugin is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these plugins will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster.",
+              "auto": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "producer_request_acks": {
+              "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).",
+              "type": "integer",
+              "one_of": [
+                -1,
+                0,
+                1
+              ],
+              "default": 1
+            }
+          },
+          {
+            "producer_request_timeout": {
+              "description": "Time to wait for a Produce response in milliseconds.",
+              "type": "integer",
+              "default": 2000
+            }
+          },
+          {
+            "producer_request_limits_messages_per_request": {
+              "description": "Maximum number of messages to include into a single producer request.",
+              "type": "integer",
+              "default": 200
+            }
+          },
+          {
+            "producer_request_limits_bytes_per_request": {
+              "description": "Maximum size of a Produce request in bytes.",
+              "type": "integer",
+              "default": 1048576
+            }
+          },
+          {
+            "producer_request_retries_max_attempts": {
+              "description": "Maximum number of retry attempts per single Produce request.",
+              "type": "integer",
+              "default": 10
+            }
+          },
+          {
+            "producer_request_retries_backoff_timeout": {
+              "description": "Backoff interval between retry attempts in milliseconds.",
+              "type": "integer",
+              "default": 100
+            }
+          },
+          {
+            "producer_async": {
+              "description": "Flag to enable asynchronous mode.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "producer_async_flush_timeout": {
+              "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.",
+              "type": "integer",
+              "default": 1000
+            }
+          },
+          {
+            "producer_async_buffering_limits_messages_in_memory": {
+              "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.",
+              "type": "integer",
+              "default": 50000
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/correlation-id/3.12.json b/schemas/correlation-id/3.12.json
new file mode 100644
index 00000000..adb35389
--- /dev/null
+++ b/schemas/correlation-id/3.12.json
@@ -0,0 +1,71 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "header_name": {
+              "description": "The HTTP header name to use for the correlation ID.",
+              "type": "string",
+              "default": "Kong-Request-ID"
+            }
+          },
+          {
+            "generator": {
+              "description": "The generator to use for the correlation ID. Accepted values are `uuid`, `uuid#counter`, and `tracker`. See [Generators](#generators).",
+              "type": "string",
+              "one_of": [
+                "uuid",
+                "uuid#counter",
+                "tracker"
+              ],
+              "default": "uuid#counter",
+              "required": true
+            }
+          },
+          {
+            "echo_downstream": {
+              "description": "Whether to echo the header back to downstream (the client).",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/cors/3.12.json b/schemas/cors/3.12.json
new file mode 100644
index 00000000..68cc465d
--- /dev/null
+++ b/schemas/cors/3.12.json
@@ -0,0 +1,149 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "len_min": 1,
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "required": true
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "origins": {
+              "description": "List of allowed domains for the `Access-Control-Allow-Origin` header. If you want to allow all origins, add `*` as a single value to this configuration field. The accepted values can either be flat strings or PCRE regexes. NOTE: If you don't specify any allowed domains, all origins are allowed.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "headers": {
+              "description": "Value for the `Access-Control-Allow-Headers` header.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "exposed_headers": {
+              "description": "Value for the `Access-Control-Expose-Headers` header. If not specified, no custom headers are exposed.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "methods": {
+              "description": "'Value for the `Access-Control-Allow-Methods` header. Available options include `GET`, `HEAD`, `PUT`, `PATCH`, `POST`, `DELETE`, `OPTIONS`, `TRACE`, `CONNECT`. By default, all options are allowed.'",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "GET",
+                  "HEAD",
+                  "PUT",
+                  "PATCH",
+                  "POST",
+                  "DELETE",
+                  "OPTIONS",
+                  "TRACE",
+                  "CONNECT"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "GET",
+                "HEAD",
+                "PUT",
+                "PATCH",
+                "POST",
+                "DELETE",
+                "OPTIONS",
+                "TRACE",
+                "CONNECT"
+              ]
+            }
+          },
+          {
+            "max_age": {
+              "description": "Indicates how long the results of the preflight request can be cached, in `seconds`.",
+              "type": "number"
+            }
+          },
+          {
+            "credentials": {
+              "description": "Flag to determine whether the `Access-Control-Allow-Credentials` header should be sent with `true` as the value.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "private_network": {
+              "description": "Flag to determine whether the `Access-Control-Allow-Private-Network` header should be sent with `true` as the value.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "preflight_continue": {
+              "description": "A boolean value that instructs the plugin to proxy the `OPTIONS` preflight request to the Upstream service.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "allow_origin_absent": {
+              "description": "A boolean value that skip cors response headers when origin header of request is empty",
+              "type": "boolean",
+              "default": true,
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/datadog/3.12.json b/schemas/datadog/3.12.json
new file mode 100644
index 00000000..56b62906
--- /dev/null
+++ b/schemas/datadog/3.12.json
@@ -0,0 +1,359 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "host": {
+              "description": "A string representing a host name, such as example.com.",
+              "referenceable": true,
+              "type": "string",
+              "default": "localhost"
+            }
+          },
+          {
+            "port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ],
+              "default": 8125
+            }
+          },
+          {
+            "prefix": {
+              "description": "String to be attached as a prefix to a metric's name.",
+              "type": "string",
+              "default": "kong"
+            }
+          },
+          {
+            "service_name_tag": {
+              "description": "String to be attached as the name of the service.",
+              "type": "string",
+              "default": "name"
+            }
+          },
+          {
+            "status_tag": {
+              "description": "String to be attached as the tag of the HTTP status.",
+              "type": "string",
+              "default": "status"
+            }
+          },
+          {
+            "consumer_tag": {
+              "description": "String to be attached as tag of the consumer.",
+              "type": "string",
+              "default": "consumer"
+            }
+          },
+          {
+            "retry_count": {
+              "description": "Number of times to retry when sending data to the upstream server.",
+              "type": "integer",
+              "deprecation": {
+                "message": "datadog: config.retry_count no longer works, please use config.queue.max_retry_time instead",
+                "removal_in_version": "4.0",
+                "old_default": 10
+              }
+            }
+          },
+          {
+            "queue_size": {
+              "description": "Maximum number of log entries to be sent on each message to the upstream server.",
+              "type": "integer",
+              "deprecation": {
+                "message": "datadog: config.queue_size is deprecated, please use config.queue.max_batch_size instead",
+                "removal_in_version": "4.0",
+                "old_default": 1
+              }
+            }
+          },
+          {
+            "flush_timeout": {
+              "description": "Optional time in seconds. If `queue_size` > 1, this is the max idle time before sending a log with less than `queue_size` records.",
+              "type": "number",
+              "deprecation": {
+                "message": "datadog: config.flush_timeout is deprecated, please use config.queue.max_coalescing_delay instead",
+                "removal_in_version": "4.0",
+                "old_default": 2
+              }
+            }
+          },
+          {
+            "queue": {
+              "type": "record",
+              "fields": [
+                {
+                  "max_batch_size": {
+                    "description": "Maximum number of entries that can be processed at a time.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_coalescing_delay": {
+                    "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.",
+                    "type": "number",
+                    "between": [
+                      0,
+                      3600
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_entries": {
+                    "description": "Maximum number of entries that can be waiting on the queue.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "max_bytes": {
+                    "description": "Maximum number of bytes that can be waiting on a queue, requires string content.",
+                    "type": "integer"
+                  }
+                },
+                {
+                  "max_retry_time": {
+                    "description": "Time in seconds before the queue gives up calling a failed handler for a batch.",
+                    "type": "number",
+                    "default": 60
+                  }
+                },
+                {
+                  "initial_retry_delay": {
+                    "description": "Time in seconds before the initial retry is made for a failing batch.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 0.01
+                  }
+                },
+                {
+                  "max_retry_delay": {
+                    "description": "Maximum time in seconds between retries, caps exponential backoff.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 60
+                  }
+                },
+                {
+                  "concurrency_limit": {
+                    "description": "The number of of queue delivery timers. -1 indicates unlimited.",
+                    "type": "integer",
+                    "one_of": [
+                      -1,
+                      1
+                    ],
+                    "default": 1
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "metrics": {
+              "description": "List of metrics to be logged.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "entity_checks": [
+                  {
+                    "conditional": {
+                      "then_field": "sample_rate",
+                      "if_match": {
+                        "one_of": [
+                          "counter",
+                          "gauge"
+                        ]
+                      },
+                      "then_match": {
+                        "required": true
+                      },
+                      "if_field": "stat_type"
+                    }
+                  }
+                ],
+                "type": "record",
+                "fields": [
+                  {
+                    "name": {
+                      "description": "Datadog metric’s name",
+                      "type": "string",
+                      "one_of": [
+                        "kong_latency",
+                        "latency",
+                        "request_count",
+                        "request_size",
+                        "response_size",
+                        "upstream_latency"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "stat_type": {
+                      "description": "Determines what sort of event the metric represents",
+                      "type": "string",
+                      "one_of": [
+                        "counter",
+                        "gauge",
+                        "histogram",
+                        "meter",
+                        "set",
+                        "timer",
+                        "distribution"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "tags": {
+                      "description": "List of tags",
+                      "type": "array",
+                      "elements": {
+                        "match": "^.*[^:]$",
+                        "type": "string"
+                      }
+                    }
+                  },
+                  {
+                    "sample_rate": {
+                      "description": "Sampling rate",
+                      "type": "number",
+                      "between": [
+                        0,
+                        1
+                      ]
+                    }
+                  },
+                  {
+                    "consumer_identifier": {
+                      "description": "Authenticated user detail",
+                      "type": "string",
+                      "one_of": [
+                        "consumer_id",
+                        "custom_id",
+                        "username"
+                      ]
+                    }
+                  }
+                ]
+              },
+              "default": [
+                {
+                  "consumer_identifier": "custom_id",
+                  "tags": [
+                    "app:kong"
+                  ],
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "request_count"
+                },
+                {
+                  "name": "latency",
+                  "stat_type": "timer",
+                  "consumer_identifier": "custom_id",
+                  "tags": [
+                    "app:kong"
+                  ]
+                },
+                {
+                  "name": "request_size",
+                  "stat_type": "timer",
+                  "consumer_identifier": "custom_id",
+                  "tags": [
+                    "app:kong"
+                  ]
+                },
+                {
+                  "name": "response_size",
+                  "stat_type": "timer",
+                  "consumer_identifier": "custom_id",
+                  "tags": [
+                    "app:kong"
+                  ]
+                },
+                {
+                  "name": "upstream_latency",
+                  "stat_type": "timer",
+                  "consumer_identifier": "custom_id",
+                  "tags": [
+                    "app:kong"
+                  ]
+                },
+                {
+                  "name": "kong_latency",
+                  "stat_type": "timer",
+                  "consumer_identifier": "custom_id",
+                  "tags": [
+                    "app:kong"
+                  ]
+                }
+              ]
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/datakit/3.12.json b/schemas/datakit/3.12.json
new file mode 100644
index 00000000..cb2bf600
--- /dev/null
+++ b/schemas/datakit/3.12.json
@@ -0,0 +1,718 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "pass_errors_to_checker": true,
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "nodes": {
+              "type": "array",
+              "elements": {
+                "description": "datakit nodes",
+                "subschema_key": "type",
+                "type": "record",
+                "subschema_override_parent": true,
+                "subschema_error": "unknown node type: %q, expected one of: call, exit, jq, property, static",
+                "fields": [
+                  {
+                    "name": {
+                      "type": "string",
+                      "examples": [
+                        {
+                          "value": "snake_case"
+                        },
+                        {
+                          "value": "SCREAMING_SNAKE_CASE"
+                        },
+                        {
+                          "value": "kebab-case"
+                        },
+                        {
+                          "value": "KEBAB-CASE"
+                        },
+                        {
+                          "value": "set-property"
+                        },
+                        {
+                          "value": "get-property"
+                        },
+                        {
+                          "value": "send_api_request"
+                        },
+                        {
+                          "value": "filter_01"
+                        },
+                        {
+                          "value": "filter_02"
+                        }
+                      ],
+                      "len_min": 1,
+                      "len_max": 255,
+                      "required": true,
+                      "description": "A label that uniquely identifies the node within the plugin configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`.",
+                      "match_all": [
+                        {
+                          "err": "must be a valid identifier",
+                          "pattern": "^[A-Za-z_][A-Za-z0-9_-]*$"
+                        }
+                      ],
+                      "match_none": [
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^_$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^context$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^ctx$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^error$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^globals$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^kong$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^ngx$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^node$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^plan$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^plugin$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^property$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^self$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^static$"
+                        },
+                        {
+                          "err": "reserved node name",
+                          "pattern": "^vars$"
+                        }
+                      ],
+                      "not_one_of": [
+                        "request",
+                        "response",
+                        "service_request",
+                        "service_response",
+                        "vault"
+                      ]
+                    }
+                  },
+                  {
+                    "type": {
+                      "type": "string",
+                      "one_of": [
+                        "call",
+                        "exit",
+                        "jq",
+                        "property",
+                        "static"
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "subschema_definitions": {
+                  "property": {
+                    "description": "Get or set a property",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "content_type": {
+                          "description": "The expected mime type of the property value. When set to `application/json`, SET operations will JSON-encode input data before writing it, and GET operations will JSON-decode output data after reading it. Otherwise, this setting has no effect.",
+                          "type": "string",
+                          "one_of": [
+                            "application/json",
+                            "text/plain",
+                            "application/octet-stream"
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "property": {
+                          "description": "The property name to get/set",
+                          "type": "string",
+                          "len_min": 1,
+                          "len_max": 255,
+                          "required": true
+                        }
+                      },
+                      {
+                        "input": {
+                          "description": "Property input source. When connected, this node operates in SET mode and writes input data to the property. Otherwise, the node operates in GET mode and reads the property.",
+                          "type": "string",
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_min": 1,
+                          "len_max": 255,
+                          "required": false
+                        }
+                      },
+                      {
+                        "output": {
+                          "description": "Property output. This can be connected regardless of whether the node is operating in GET mode or SET mode.",
+                          "type": "string",
+                          "len_min": 1,
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_max": 255,
+                          "required": false
+                        }
+                      }
+                    ]
+                  },
+                  "call": {
+                    "description": "Make an external HTTP request",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "method": {
+                          "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters.",
+                          "type": "string",
+                          "len_max": 32,
+                          "len_min": 1,
+                          "match": "^%u+$",
+                          "default": "GET"
+                        }
+                      },
+                      {
+                        "ssl_server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ]
+                        }
+                      },
+                      {
+                        "url": {
+                          "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                          "type": "string",
+                          "required": true
+                        }
+                      },
+                      {
+                        "input": {
+                          "description": "call node input",
+                          "type": "string",
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_min": 1,
+                          "len_max": 255,
+                          "required": false
+                        }
+                      },
+                      {
+                        "inputs": {
+                          "description": "call node inputs",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "body": {
+                                "description": "HTTP request body",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_min": 1,
+                                "len_max": 255,
+                                "required": false
+                              }
+                            },
+                            {
+                              "headers": {
+                                "description": "HTTP request headers",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_min": 1,
+                                "len_max": 255,
+                                "required": false
+                              }
+                            },
+                            {
+                              "query": {
+                                "description": "HTTP request query",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_min": 1,
+                                "len_max": 255,
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "output": {
+                          "description": "call node output",
+                          "type": "string",
+                          "len_min": 1,
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_max": 255,
+                          "required": false
+                        }
+                      },
+                      {
+                        "outputs": {
+                          "description": "call node outputs",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "body": {
+                                "description": "HTTP response body",
+                                "type": "string",
+                                "len_min": 1,
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_max": 255,
+                                "required": false
+                              }
+                            },
+                            {
+                              "headers": {
+                                "description": "HTTP response headers",
+                                "type": "string",
+                                "len_min": 1,
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_max": 255,
+                                "required": false
+                              }
+                            },
+                            {
+                              "status": {
+                                "description": "HTTP response status code",
+                                "type": "string",
+                                "len_min": 1,
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_max": 255,
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "entity_checks": [
+                      {
+                        "mutually_exclusive": [
+                          "input",
+                          "inputs"
+                        ]
+                      },
+                      {
+                        "mutually_exclusive": [
+                          "output",
+                          "outputs"
+                        ]
+                      }
+                    ]
+                  },
+                  "static": {
+                    "description": "Produce reusable outputs from statically-configured values",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "values": {
+                          "description": "An object with string keys and freeform values",
+                          "type": "json",
+                          "required": true,
+                          "json_schema": {
+                            "inline": {
+                              "type": "object"
+                            }
+                          }
+                        }
+                      },
+                      {
+                        "output": {
+                          "description": "The entire `.values` map",
+                          "type": "string",
+                          "len_min": 1,
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_max": 255,
+                          "required": false
+                        }
+                      },
+                      {
+                        "outputs": {
+                          "description": "Individual items from `.values`, referenced by key",
+                          "type": "map",
+                          "values": {
+                            "match_any": {
+                              "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                              "patterns": [
+                                "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                              ]
+                            },
+                            "len_min": 1,
+                            "len_max": 255,
+                            "type": "string"
+                          },
+                          "keys": {
+                            "len_min": 1,
+                            "len_max": 255,
+                            "type": "string"
+                          },
+                          "required": false
+                        }
+                      }
+                    ],
+                    "entity_checks": [
+                      {
+                        "mutually_exclusive": [
+                          "output",
+                          "outputs"
+                        ]
+                      }
+                    ]
+                  },
+                  "exit": {
+                    "description": "Terminate the request and send a response to the client",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "status": {
+                          "description": "HTTP status code",
+                          "type": "integer",
+                          "default": 200,
+                          "between": [
+                            200,
+                            599
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "warn_headers_sent": {
+                          "type": "boolean",
+                          "required": false
+                        }
+                      },
+                      {
+                        "input": {
+                          "description": "exit node input",
+                          "type": "string",
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_min": 1,
+                          "len_max": 255,
+                          "required": false
+                        }
+                      },
+                      {
+                        "inputs": {
+                          "description": "exit node inputs",
+                          "type": "record",
+                          "fields": [
+                            {
+                              "body": {
+                                "description": "HTTP response body",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_min": 1,
+                                "len_max": 255,
+                                "required": false
+                              }
+                            },
+                            {
+                              "headers": {
+                                "description": "HTTP response headers",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                                  "patterns": [
+                                    "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                    "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                                  ]
+                                },
+                                "len_min": 1,
+                                "len_max": 255,
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "entity_checks": [
+                      {
+                        "mutually_exclusive": [
+                          "input",
+                          "inputs"
+                        ]
+                      }
+                    ]
+                  },
+                  "jq": {
+                    "description": "Process data using `jq` syntax",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "jq": {
+                          "description": "The jq filter text. Refer to https://jqlang.org/manual/ for full documentation.",
+                          "type": "string",
+                          "len_min": 1,
+                          "len_max": 10240,
+                          "required": true
+                        }
+                      },
+                      {
+                        "input": {
+                          "description": "filter input(s)",
+                          "type": "string",
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_min": 1,
+                          "len_max": 255,
+                          "required": false
+                        }
+                      },
+                      {
+                        "inputs": {
+                          "description": "filter input(s)",
+                          "type": "map",
+                          "values": {
+                            "match_any": {
+                              "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                              "patterns": [
+                                "^[A-Za-z_][A-Za-z0-9_-]*$",
+                                "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                              ]
+                            },
+                            "len_min": 1,
+                            "len_max": 255,
+                            "type": "string"
+                          },
+                          "keys": {
+                            "len_min": 1,
+                            "len_max": 255,
+                            "type": "string"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "output": {
+                          "description": "filter output(s)",
+                          "type": "string",
+                          "len_min": 1,
+                          "match_any": {
+                            "err": "must be one of NODE_NAME or NODE_NAME.FIELD",
+                            "patterns": [
+                              "^[A-Za-z_][A-Za-z0-9_-]*$",
+                              "^[A-Za-z_][A-Za-z0-9_-]*%..+$"
+                            ]
+                          },
+                          "len_max": 255,
+                          "required": false
+                        }
+                      }
+                    ],
+                    "entity_checks": [
+                      {
+                        "mutually_exclusive": [
+                          "input",
+                          "inputs"
+                        ]
+                      }
+                    ]
+                  }
+                }
+              },
+              "len_min": 1,
+              "len_max": 64,
+              "required": true
+            }
+          },
+          {
+            "resources": {
+              "type": "record",
+              "fields": [
+                {
+                  "vault": {
+                    "keys": {
+                      "type": "string",
+                      "len_min": 1,
+                      "match_all": [
+                        {
+                          "err": "must be a valid identifier",
+                          "pattern": "^[A-Za-z_][A-Za-z0-9_-]*$"
+                        }
+                      ],
+                      "len_max": 255
+                    },
+                    "type": "map",
+                    "values": {
+                      "referenceable": true,
+                      "type": "string",
+                      "len_min": 1,
+                      "len_max": 4095,
+                      "required": true
+                    },
+                    "len_min": 1,
+                    "len_max": 64,
+                    "required": false
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "debug": {
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/degraphql/3.12.json b/schemas/degraphql/3.12.json
new file mode 100644
index 00000000..43c43b7b
--- /dev/null
+++ b/schemas/degraphql/3.12.json
@@ -0,0 +1,66 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "graphql_server_path": {
+              "description": "The GraphQL endpoint serve path",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "default": "/graphql",
+              "starts_with": "/",
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/exit-transformer/3.12.json b/schemas/exit-transformer/3.12.json
new file mode 100644
index 00000000..c0deadd2
--- /dev/null
+++ b/schemas/exit-transformer/3.12.json
@@ -0,0 +1,66 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "functions": {
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": true
+            }
+          },
+          {
+            "handle_unknown": {
+              "description": "Determines whether to handle unknown status codes by transforming their responses.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "handle_unexpected": {
+              "description": "Determines whether to handle unexpected errors by transforming their responses.",
+              "type": "boolean",
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/file-log/3.12.json b/schemas/file-log/3.12.json
new file mode 100644
index 00000000..39672d45
--- /dev/null
+++ b/schemas/file-log/3.12.json
@@ -0,0 +1,81 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "path": {
+              "err": "not a valid filename",
+              "type": "string",
+              "description": "The file path of the output log file. The plugin creates the log file if it doesn't exist yet.",
+              "match": "^[^%s*&%%\\`][^*&%%\\`]*[^%s*&%%\\`]$",
+              "required": true
+            }
+          },
+          {
+            "reopen": {
+              "description": "Determines whether the log file is closed and reopened on every request.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "custom_fields_by_lua": {
+              "keys": {
+                "type": "string",
+                "len_min": 1
+              },
+              "type": "map",
+              "values": {
+                "type": "string",
+                "len_min": 1
+              },
+              "description": "Lua code as a key-value map"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/forward-proxy/3.12.json b/schemas/forward-proxy/3.12.json
new file mode 100644
index 00000000..1cdafab1
--- /dev/null
+++ b/schemas/forward-proxy/3.12.json
@@ -0,0 +1,170 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "http_proxy_host",
+              "https_proxy_host"
+            ]
+          },
+          {
+            "at_least_one_of": [
+              "http_proxy_port",
+              "https_proxy_port"
+            ]
+          },
+          {
+            "mutually_required": [
+              "http_proxy_host",
+              "http_proxy_port"
+            ]
+          },
+          {
+            "mutually_required": [
+              "https_proxy_host",
+              "https_proxy_port"
+            ]
+          }
+        ],
+        "type": "record",
+        "shorthand_fields": [
+          {
+            "proxy_host": {
+              "deprecation": {
+                "message": "forward-proxy: config.proxy_host is deprecated, please use config.http_proxy_host instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "proxy_port": {
+              "deprecation": {
+                "message": "forward-proxy: config.proxy_port is deprecated, please use config.http_proxy_port instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "integer"
+            }
+          }
+        ],
+        "fields": [
+          {
+            "x_headers": {
+              "description": "Determines how to handle headers when forwarding the request.",
+              "type": "string",
+              "one_of": [
+                "append",
+                "transparent",
+                "delete"
+              ],
+              "required": true,
+              "default": "append"
+            }
+          },
+          {
+            "http_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "https_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "https_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "proxy_scheme": {
+              "description": "The proxy scheme to use when connecting. Only `http` is supported.",
+              "type": "string",
+              "one_of": [
+                "http"
+              ],
+              "required": true,
+              "default": "http"
+            }
+          },
+          {
+            "auth_username": {
+              "description": "The username to authenticate with, if the forward proxy is protected\nby basic authentication.",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "auth_password": {
+              "description": "The password to authenticate with, if the forward proxy is protected\nby basic authentication.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "https_verify": {
+              "description": "Whether the server certificate will be verified according to the CA certificates specified in lua_ssl_trusted_certificate.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/graphql-proxy-cache-advanced/3.12.json b/schemas/graphql-proxy-cache-advanced/3.12.json
new file mode 100644
index 00000000..6ccfe500
--- /dev/null
+++ b/schemas/graphql-proxy-cache-advanced/3.12.json
@@ -0,0 +1,466 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "strategy": {
+              "description": "The backing data store in which to hold cached entities. Accepted value is `memory`.",
+              "type": "string",
+              "one_of": [
+                "memory",
+                "redis"
+              ],
+              "required": true,
+              "default": "memory"
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "TTL in seconds of cache entities. Must be a value greater than 0.",
+              "type": "integer",
+              "gt": 0,
+              "default": 300
+            }
+          },
+          {
+            "memory": {
+              "type": "record",
+              "fields": [
+                {
+                  "dictionary_name": {
+                    "description": "The name of the shared dictionary in which to hold cache entities when the memory strategy is selected. This dictionary currently must be defined manually in the Kong Nginx template.",
+                    "type": "string",
+                    "default": "kong_db_cache",
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "default": 5,
+                    "required": false
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "bypass_on_err": {
+              "description": "Unhandled errors while trying to retrieve a cache entry (such as redis down) are resolved with `Bypass`, with the request going upstream.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "vary_headers": {
+              "description": "Relevant headers considered for the cache key. If undefined, none of the headers are taken into consideration.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/graphql-rate-limiting-advanced/3.12.json b/schemas/graphql-rate-limiting-advanced/3.12.json
new file mode 100644
index 00000000..474a0c60
--- /dev/null
+++ b/schemas/graphql-rate-limiting-advanced/3.12.json
@@ -0,0 +1,543 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "identifier": {
+              "description": "How to define the rate limit key. Can be `ip`, `credential`, `consumer`.",
+              "type": "string",
+              "one_of": [
+                "ip",
+                "credential",
+                "consumer"
+              ],
+              "required": true,
+              "default": "consumer"
+            }
+          },
+          {
+            "window_size": {
+              "description": "One or more window sizes to apply a limit to (defined in seconds).",
+              "type": "array",
+              "elements": {
+                "type": "number"
+              },
+              "required": true
+            }
+          },
+          {
+            "window_type": {
+              "description": "Sets the time window to either `sliding` or `fixed`.",
+              "type": "string",
+              "one_of": [
+                "fixed",
+                "sliding"
+              ],
+              "default": "sliding"
+            }
+          },
+          {
+            "limit": {
+              "description": "One or more requests-per-window limits to apply.",
+              "type": "array",
+              "elements": {
+                "type": "number"
+              },
+              "required": true
+            }
+          },
+          {
+            "sync_rate": {
+              "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 syncs the counters in that many number of seconds.",
+              "type": "number",
+              "required": true
+            }
+          },
+          {
+            "namespace": {
+              "description": "The rate limiting namespace to use for this plugin instance. This namespace is used to share rate limiting counters across different instances. If it is not provided, a random UUID is generated. NOTE: For the plugin instances sharing the same namespace, all the configurations that are required for synchronizing counters, e.g. `strategy`, `redis`, `sync_rate`, `window_size`, `dictionary_name`, need to be the same.",
+              "auto": true,
+              "type": "string"
+            }
+          },
+          {
+            "strategy": {
+              "description": "The rate-limiting strategy to use for retrieving and incrementing the limits.",
+              "type": "string",
+              "one_of": [
+                "cluster",
+                "redis"
+              ],
+              "required": true,
+              "default": "cluster"
+            }
+          },
+          {
+            "dictionary_name": {
+              "description": "The shared dictionary where counters will be stored until the next sync cycle.",
+              "type": "string",
+              "required": true,
+              "default": "kong_rate_limiting_counters"
+            }
+          },
+          {
+            "hide_client_headers": {
+              "description": "Optionally hide informative response headers. Available options: `true` or `false`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "cost_strategy": {
+              "description": "Strategy to use to evaluate query costs. Either `default` or `node_quantifier`.",
+              "type": "string",
+              "one_of": [
+                "default",
+                "node_quantifier"
+              ],
+              "default": "default"
+            }
+          },
+          {
+            "score_factor": {
+              "description": "A scoring factor to multiply (or divide) the cost. The `score_factor` must always be greater than 0.",
+              "type": "number",
+              "gt": 0,
+              "required": false,
+              "default": 1
+            }
+          },
+          {
+            "max_cost": {
+              "description": "A defined maximum cost per query. 0 means unlimited.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "default": 5,
+                    "required": false
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "pass_all_downstream_headers": {
+              "description": "pass all downstream headers to the upstream graphql server in introspection request",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/grpc-gateway/3.12.json b/schemas/grpc-gateway/3.12.json
new file mode 100644
index 00000000..e6ca4fa2
--- /dev/null
+++ b/schemas/grpc-gateway/3.12.json
@@ -0,0 +1,57 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "proto": {
+              "description": "Describes the gRPC types and methods.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/grpc-web/3.12.json b/schemas/grpc-web/3.12.json
new file mode 100644
index 00000000..b50a5704
--- /dev/null
+++ b/schemas/grpc-web/3.12.json
@@ -0,0 +1,72 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "proto": {
+              "description": "If present, describes the gRPC types and methods. Required to support payload transcoding. When absent, the web client must use application/grpw-web+proto content.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "pass_stripped_path": {
+              "description": "If set to `true` causes the plugin to pass the stripped request path to the upstream gRPC service.",
+              "type": "boolean",
+              "required": false
+            }
+          },
+          {
+            "allow_origin_header": {
+              "description": "The value of the `Access-Control-Allow-Origin` header in the response to the gRPC-Web client.",
+              "type": "string",
+              "required": false,
+              "default": "*"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/header-cert-auth/3.12.json b/schemas/header-cert-auth/3.12.json
new file mode 100644
index 00000000..8a4d8d77
--- /dev/null
+++ b/schemas/header-cert-auth/3.12.json
@@ -0,0 +1,227 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "mutually_required": [
+              "http_proxy_host",
+              "http_proxy_port"
+            ]
+          },
+          {
+            "mutually_required": [
+              "https_proxy_host",
+              "https_proxy_port"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "certificate_header_name": {
+              "description": "Name of the header that contains the certificate, received from the WAF or other L7 downstream proxy.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "certificate_header_format": {
+              "description": "Format of the certificate header. Supported formats: `base64_encoded`, `url_encoded`.",
+              "type": "string",
+              "one_of": [
+                "base64_encoded",
+                "url_encoded"
+              ],
+              "required": true
+            }
+          },
+          {
+            "secure_source": {
+              "description": "Whether to secure the source of the request. If set to `true`, the plugin will only allow requests from trusted IPs (configured by the `trusted_ips` config option).",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string"
+            }
+          },
+          {
+            "consumer_by": {
+              "description": "Whether to match the subject name of the client-supplied certificate against consumer's `username` and/or `custom_id` attribute. If set to `[]` (the empty array), then auto-matching is disabled.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "ca_certificates": {
+              "description": "List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (`id`).",
+              "type": "array",
+              "elements": {
+                "uuid": true,
+                "type": "string"
+              },
+              "required": true
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "Cache expiry time in seconds.",
+              "type": "number",
+              "required": true,
+              "default": 60
+            }
+          },
+          {
+            "skip_consumer_lookup": {
+              "description": "Skip consumer lookup once certificate is trusted against the configured CA list.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "allow_partial_chain": {
+              "description": "Allow certificate verification with only an intermediate certificate. When this is enabled, you don't need to upload the full chain to Kong Certificates.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "authenticated_group_by": {
+              "description": "Certificate property to use as the authenticated group. Valid values are `CN` (Common Name) or `DN` (Distinguished Name). Once `skip_consumer_lookup` is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create allowed or denied groups of users.",
+              "type": "string",
+              "one_of": [
+                "CN",
+                "DN"
+              ],
+              "required": false,
+              "default": "CN"
+            }
+          },
+          {
+            "revocation_check_mode": {
+              "description": "Controls client certificate revocation check behavior. If set to `SKIP`, no revocation check is performed. If set to `IGNORE_CA_ERROR`, the plugin respects the revocation status when either OCSP or CRL URL is set, and doesn't fail on network issues. If set to `STRICT`, the plugin only treats the certificate as valid when it's able to verify the revocation status.",
+              "type": "string",
+              "one_of": [
+                "SKIP",
+                "IGNORE_CA_ERROR",
+                "STRICT"
+              ],
+              "required": false,
+              "default": "IGNORE_CA_ERROR"
+            }
+          },
+          {
+            "http_timeout": {
+              "description": "HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.",
+              "type": "number",
+              "default": 30000
+            }
+          },
+          {
+            "cert_cache_ttl": {
+              "description": "The length of time in milliseconds between refreshes of the revocation check status cache.",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "default_consumer": {
+              "description": "The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "https_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "https_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/hmac-auth/3.12.json b/schemas/hmac-auth/3.12.json
new file mode 100644
index 00000000..92ddf18a
--- /dev/null
+++ b/schemas/hmac-auth/3.12.json
@@ -0,0 +1,130 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.algorithms"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to show or hide the credential from the upstream service.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "clock_skew": {
+              "description": "Clock skew in seconds to prevent replay attacks.",
+              "type": "number",
+              "gt": 0,
+              "default": 300
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (Consumer UUID or username) value to use as an “anonymous” consumer if authentication fails.",
+              "type": "string"
+            }
+          },
+          {
+            "validate_request_body": {
+              "description": "A boolean value telling the plugin to enable body validation.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "enforce_headers": {
+              "description": "A list of headers that the client should at least use for HTTP signature creation.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "algorithms": {
+              "description": "A list of HMAC digest algorithms that the user wants to support. Allowed values are `hmac-sha1`, `hmac-sha256`, `hmac-sha384`, and `hmac-sha512`",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "hmac-sha1",
+                  "hmac-sha256",
+                  "hmac-sha384",
+                  "hmac-sha512"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "hmac-sha1",
+                "hmac-sha256",
+                "hmac-sha384",
+                "hmac-sha512"
+              ]
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/http-log/3.12.json b/schemas/http-log/3.12.json
new file mode 100644
index 00000000..bd13299b
--- /dev/null
+++ b/schemas/http-log/3.12.json
@@ -0,0 +1,258 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "http_endpoint": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "method": {
+              "description": "An optional method used to send data to the HTTP server. Supported values are `POST` (default), `PUT`, and `PATCH`.",
+              "type": "string",
+              "one_of": [
+                "POST",
+                "PUT",
+                "PATCH"
+              ],
+              "default": "POST"
+            }
+          },
+          {
+            "content_type": {
+              "description": "Indicates the type of data sent. The only available option is `application/json`.",
+              "type": "string",
+              "one_of": [
+                "application/json",
+                "application/json; charset=utf-8"
+              ],
+              "default": "application/json"
+            }
+          },
+          {
+            "timeout": {
+              "description": "An optional timeout in milliseconds when sending data to the upstream server.",
+              "type": "number",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "An optional value in milliseconds that defines how long an idle connection will live before being closed.",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "retry_count": {
+              "description": "Number of times to retry when sending data to the upstream server.",
+              "type": "integer",
+              "deprecation": {
+                "old_default": 10,
+                "removal_in_version": "4.0",
+                "message": "http-log: config.retry_count no longer works, please use config.queue.max_retry_time instead"
+              }
+            }
+          },
+          {
+            "queue_size": {
+              "description": "Maximum number of log entries to be sent on each message to the upstream server.",
+              "type": "integer",
+              "deprecation": {
+                "old_default": 1,
+                "removal_in_version": "4.0",
+                "message": "http-log: config.queue_size is deprecated, please use config.queue.max_batch_size instead"
+              }
+            }
+          },
+          {
+            "flush_timeout": {
+              "description": "Optional time in seconds. If `queue_size` > 1, this is the max idle time before sending a log with less than `queue_size` records.",
+              "type": "number",
+              "deprecation": {
+                "old_default": 2,
+                "removal_in_version": "4.0",
+                "message": "http-log: config.flush_timeout is deprecated, please use config.queue.max_coalescing_delay instead"
+              }
+            }
+          },
+          {
+            "headers": {
+              "description": "An optional table of headers included in the HTTP message to the upstream server. Values are indexed by header name, and each header name accepts a single string.",
+              "type": "map",
+              "values": {
+                "type": "string",
+                "referenceable": true
+              },
+              "keys": {
+                "match_none": [
+                  {
+                    "pattern": "^[Hh][Oo][Ss][Tt]$",
+                    "err": "cannot contain 'Host' header"
+                  },
+                  {
+                    "pattern": "^[Cc][Oo][Nn][Tt][Ee][Nn][Tt]%-[Ll][Ee][nn][Gg][Tt][Hh]$",
+                    "err": "cannot contain 'Content-Length' header"
+                  },
+                  {
+                    "pattern": "^[Cc][Oo][Nn][Tt][Ee][Nn][Tt]%-[Tt][Yy][Pp][Ee]$",
+                    "err": "cannot contain 'Content-Type' header"
+                  }
+                ],
+                "type": "string",
+                "description": "A string representing an HTTP header name."
+              }
+            }
+          },
+          {
+            "queue": {
+              "type": "record",
+              "fields": [
+                {
+                  "max_batch_size": {
+                    "description": "Maximum number of entries that can be processed at a time.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_coalescing_delay": {
+                    "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.",
+                    "type": "number",
+                    "between": [
+                      0,
+                      3600
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_entries": {
+                    "description": "Maximum number of entries that can be waiting on the queue.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "max_bytes": {
+                    "description": "Maximum number of bytes that can be waiting on a queue, requires string content.",
+                    "type": "integer"
+                  }
+                },
+                {
+                  "max_retry_time": {
+                    "description": "Time in seconds before the queue gives up calling a failed handler for a batch.",
+                    "type": "number",
+                    "default": 60
+                  }
+                },
+                {
+                  "initial_retry_delay": {
+                    "description": "Time in seconds before the initial retry is made for a failing batch.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 0.01
+                  }
+                },
+                {
+                  "max_retry_delay": {
+                    "description": "Maximum time in seconds between retries, caps exponential backoff.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 60
+                  }
+                },
+                {
+                  "concurrency_limit": {
+                    "description": "The number of of queue delivery timers. -1 indicates unlimited.",
+                    "type": "integer",
+                    "one_of": [
+                      -1,
+                      1
+                    ],
+                    "default": 1
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "custom_fields_by_lua": {
+              "keys": {
+                "type": "string",
+                "len_min": 1
+              },
+              "type": "map",
+              "values": {
+                "type": "string",
+                "len_min": 1
+              },
+              "description": "Lua code as a key-value map"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/injection-protection/3.12.json b/schemas/injection-protection/3.12.json
new file mode 100644
index 00000000..135142b5
--- /dev/null
+++ b/schemas/injection-protection/3.12.json
@@ -0,0 +1,157 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "injection_types",
+              "custom_injections"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "injection_types": {
+              "description": "The type of injections to check for.",
+              "type": "set",
+              "required": true,
+              "elements": {
+                "one_of": [
+                  "sql",
+                  "js",
+                  "ssi",
+                  "xpath_abbreviated",
+                  "xpath_extended",
+                  "java_exception"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "sql"
+              ]
+            }
+          },
+          {
+            "locations": {
+              "description": "The locations to check for injection.",
+              "type": "set",
+              "required": true,
+              "elements": {
+                "one_of": [
+                  "headers",
+                  "path_and_query",
+                  "body"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "path_and_query"
+              ]
+            }
+          },
+          {
+            "custom_injections": {
+              "description": "Custom regexes to check for.",
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "name": {
+                      "description": "A unique name for this injection.",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "regex": {
+                      "description": "The regex to match against.",
+                      "type": "string",
+                      "is_regex": true,
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "default": null
+            }
+          },
+          {
+            "enforcement_mode": {
+              "description": "Enforcement mode of the security policy.",
+              "type": "string",
+              "one_of": [
+                "block",
+                "log_only"
+              ],
+              "default": "block",
+              "required": true
+            }
+          },
+          {
+            "error_status_code": {
+              "description": "The response status code when validation fails.",
+              "type": "integer",
+              "default": 400,
+              "between": [
+                400,
+                499
+              ],
+              "required": true
+            }
+          },
+          {
+            "error_message": {
+              "description": "The response message when validation fails",
+              "type": "string",
+              "default": "Bad Request",
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ip-restriction/3.12.json b/schemas/ip-restriction/3.12.json
new file mode 100644
index 00000000..572266fb
--- /dev/null
+++ b/schemas/ip-restriction/3.12.json
@@ -0,0 +1,85 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.allow",
+        "config.deny"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "required": true,
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "default": [
+          "http",
+          "https",
+          "tcp",
+          "tls",
+          "grpc",
+          "grpcs"
+        ]
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "allow": {
+              "description": "List of IPs or CIDR ranges to allow. One of `config.allow` or `config.deny` must be specified.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing an IP address or CIDR block, such as 192.168.1.1 or 192.168.0.0/16.",
+                "type": "string"
+              }
+            }
+          },
+          {
+            "deny": {
+              "description": "List of IPs or CIDR ranges to deny. One of `config.allow` or `config.deny` must be specified.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing an IP address or CIDR block, such as 192.168.1.1 or 192.168.0.0/16.",
+                "type": "string"
+              }
+            }
+          },
+          {
+            "status": {
+              "description": "The HTTP status of the requests that will be rejected by the plugin.",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "message": {
+              "description": "The message to send as a response body to rejected requests.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/jq/3.12.json b/schemas/jq/3.12.json
new file mode 100644
index 00000000..cd4b76b1
--- /dev/null
+++ b/schemas/jq/3.12.json
@@ -0,0 +1,191 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "request_jq_program",
+              "response_jq_program"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "request_jq_program": {
+              "required": false,
+              "type": "string"
+            }
+          },
+          {
+            "request_jq_program_options": {
+              "required": false,
+              "type": "record",
+              "fields": [
+                {
+                  "compact_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": true
+                  }
+                },
+                {
+                  "raw_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                },
+                {
+                  "join_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                },
+                {
+                  "ascii_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                },
+                {
+                  "sort_keys": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                }
+              ],
+              "default": []
+            }
+          },
+          {
+            "request_if_media_type": {
+              "required": false,
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "application/json"
+              ]
+            }
+          },
+          {
+            "response_jq_program": {
+              "required": false,
+              "type": "string"
+            }
+          },
+          {
+            "response_jq_program_options": {
+              "required": false,
+              "type": "record",
+              "fields": [
+                {
+                  "compact_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": true
+                  }
+                },
+                {
+                  "raw_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                },
+                {
+                  "join_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                },
+                {
+                  "ascii_output": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                },
+                {
+                  "sort_keys": {
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                }
+              ],
+              "default": []
+            }
+          },
+          {
+            "response_if_media_type": {
+              "required": false,
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "application/json"
+              ]
+            }
+          },
+          {
+            "response_if_status_code": {
+              "required": false,
+              "type": "array",
+              "elements": {
+                "between": [
+                  100,
+                  599
+                ],
+                "type": "integer"
+              },
+              "default": [
+                200
+              ]
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/json-threat-protection/3.12.json b/schemas/json-threat-protection/3.12.json
new file mode 100644
index 00000000..030cbde8
--- /dev/null
+++ b/schemas/json-threat-protection/3.12.json
@@ -0,0 +1,172 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.max_body_size",
+          "config.max_container_depth"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "max_body_size": {
+              "description": "Max size of the request body. -1 means unlimited.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                -1,
+                2147483648
+              ],
+              "default": 8192
+            }
+          },
+          {
+            "max_container_depth": {
+              "description": "Max nested depth of objects and arrays. -1 means unlimited.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                -1,
+                2147483648
+              ],
+              "default": -1
+            }
+          },
+          {
+            "max_object_entry_count": {
+              "description": "Max number of entries in an object. -1 means unlimited.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                -1,
+                2147483648
+              ],
+              "default": -1
+            }
+          },
+          {
+            "max_object_entry_name_length": {
+              "description": "Max string length of object name. -1 means unlimited.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                -1,
+                2147483648
+              ],
+              "default": -1
+            }
+          },
+          {
+            "max_array_element_count": {
+              "description": "Max number of elements in an array. -1 means unlimited.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                -1,
+                2147483648
+              ],
+              "default": -1
+            }
+          },
+          {
+            "max_string_value_length": {
+              "description": "Max string value length. -1 means unlimited.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                -1,
+                2147483648
+              ],
+              "default": -1
+            }
+          },
+          {
+            "allow_duplicate_object_entry_name": {
+              "description": "Allow or disallow duplicate object entry name.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "enforcement_mode": {
+              "description": "Enforcement mode of the security policy.",
+              "type": "string",
+              "one_of": [
+                "block",
+                "log_only"
+              ],
+              "default": "block",
+              "required": false
+            }
+          },
+          {
+            "error_status_code": {
+              "description": "The response status code when validation fails.",
+              "type": "integer",
+              "default": 400,
+              "between": [
+                400,
+                499
+              ],
+              "required": false
+            }
+          },
+          {
+            "error_message": {
+              "description": "The response message when validation fails",
+              "type": "string",
+              "required": false,
+              "default": "Bad Request"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/jwe-decrypt/3.12.json b/schemas/jwe-decrypt/3.12.json
new file mode 100644
index 00000000..0b11b6c2
--- /dev/null
+++ b/schemas/jwe-decrypt/3.12.json
@@ -0,0 +1,84 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "lookup_header_name": {
+              "description": "The name of the header to look for the JWE token.",
+              "type": "string",
+              "required": true,
+              "default": "Authorization"
+            }
+          },
+          {
+            "forward_header_name": {
+              "description": "The name of the header that is used to set the decrypted value.",
+              "type": "string",
+              "required": true,
+              "default": "Authorization"
+            }
+          },
+          {
+            "key_sets": {
+              "description": "Denote the name or names of all Key Sets that should be inspected when trying to find a suitable key to decrypt the JWE token.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": true
+            }
+          },
+          {
+            "strict": {
+              "description": "Defines how the plugin behaves in cases where no token was found in the request. When using `strict` mode, the request requires a token to be present and subsequently raise an error if none could be found.",
+              "type": "boolean",
+              "default": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/jwt-signer/3.12.json b/schemas/jwt-signer/3.12.json
new file mode 100644
index 00000000..e19eb434
--- /dev/null
+++ b/schemas/jwt-signer/3.12.json
@@ -0,0 +1,981 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config.access_token_upstream_header",
+          "config.channel_token_upstream_header",
+          "config.original_access_token_upstream_header",
+          "config.original_channel_token_upstream_header"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "mutually_required": [
+              "access_token_jwks_uri_client_username",
+              "access_token_jwks_uri_client_password"
+            ]
+          },
+          {
+            "mutually_required": [
+              "access_token_keyset_client_username",
+              "access_token_keyset_client_password"
+            ]
+          },
+          {
+            "mutually_required": [
+              "channel_token_jwks_uri_client_username",
+              "channel_token_jwks_uri_client_password"
+            ]
+          },
+          {
+            "mutually_required": [
+              "channel_token_keyset_client_username",
+              "channel_token_keyset_client_password"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "realm": {
+              "description": "When authentication or authorization fails, or there is an unexpected error, the plugin sends an `WWW-Authenticate` header with the `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "enable_hs_signatures": {
+              "description": "Tokens signed with HMAC algorithms such as `HS256`, `HS384`, or `HS512` are not accepted by default. If you need to accept such tokens for verification, enable this setting.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "enable_instrumentation": {
+              "description": "Writes log entries with some added information using `ngx.CRIT` (CRITICAL) level.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "access_token_issuer": {
+              "description": "The `iss` claim of a signed or re-signed access token is set to this value. Original `iss` claim of the incoming token (possibly introspected) is stored in `original_iss` claim of the newly signed access token.",
+              "type": "string",
+              "required": false,
+              "default": "kong"
+            }
+          },
+          {
+            "access_token_keyset": {
+              "description": "The name of the keyset containing signing keys.",
+              "type": "string",
+              "required": false,
+              "default": "kong"
+            }
+          },
+          {
+            "access_token_keyset_client_username": {
+              "description": "The client username that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_password`",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "access_token_keyset_client_password": {
+              "description": "The client password that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_username`",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "access_token_keyset_client_certificate": {
+              "description": "The client certificate that will be used to authenticate Kong if `access_token_keyset` is an https uri that requires mTLS Auth.",
+              "reference": "certificates",
+              "type": "foreign",
+              "required": false
+            }
+          },
+          {
+            "access_token_keyset_rotate_period": {
+              "description": "Specify the period (in seconds) to auto-rotate the jwks for `access_token_keyset`. The default value 0 means no auto-rotation.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "access_token_jwks_uri": {
+              "description": "Specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the access token.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "access_token_jwks_uri_client_username": {
+              "description": "The client username that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_password`",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "access_token_jwks_uri_client_password": {
+              "description": "The client password that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_username`",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "access_token_jwks_uri_client_certificate": {
+              "description": "The client certificate that will be used to authenticate Kong if `access_token_jwks_uri` is an https uri that requires mTLS Auth.",
+              "reference": "certificates",
+              "type": "foreign",
+              "required": false
+            }
+          },
+          {
+            "access_token_jwks_uri_rotate_period": {
+              "description": "Specify the period (in seconds) to auto-rotate the jwks for `access_token_jwks_uri`. The default value 0 means no auto-rotation.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "access_token_request_header": {
+              "description": "This parameter tells the name of the header where to look for the access token.",
+              "type": "string",
+              "required": false,
+              "default": "Authorization"
+            }
+          },
+          {
+            "access_token_leeway": {
+              "description": "Adjusts clock skew between the token issuer and Kong. The value is added to the token's `exp` claim before checking token expiry against Kong servers' current time in seconds. You can disable access token `expiry` verification altogether with `config.verify_access_token_expiry`.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "access_token_scopes_required": {
+              "description": "Specify the required values (or scopes) that are checked by a claim specified by `config.access_token_scopes_claim`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "access_token_scopes_claim": {
+              "description": "Specify the claim in an access token to verify against values of `config.access_token_scopes_required`.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "scope"
+              ]
+            }
+          },
+          {
+            "access_token_consumer_claim": {
+              "description": "When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (for example, `sub` or `username`) in an access token to Kong consumer entity.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "access_token_consumer_by": {
+              "description": "When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are `id`, `username`, and `custom_id`.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "id",
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "access_token_upstream_header": {
+              "description": "Removes the `config.access_token_request_header` from the request after reading its value. With `config.access_token_upstream_header`, you can specify the upstream header where the plugin adds the Kong signed token. If you don't specify a value, such as use `null` or `\"\"` (empty string), the plugin does not even try to sign or re-sign the token.",
+              "type": "string",
+              "required": false,
+              "default": "Authorization:Bearer"
+            }
+          },
+          {
+            "access_token_upstream_leeway": {
+              "description": "If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's `exp` claim.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "access_token_introspection_endpoint": {
+              "description": "When you use `opaque` access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "access_token_introspection_authorization": {
+              "description": "If the introspection endpoint requires client authentication (client being the JWT Signer plugin), you can specify the `Authorization` header's value with this configuration parameter.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "access_token_introspection_body_args": {
+              "description": "This parameter allows you to pass URL encoded request body arguments. For example: `resource=` or `a=1&b=&c`.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "access_token_introspection_hint": {
+              "description": "If you need to give `hint` parameter when introspecting an access token, use this parameter to specify the value. By default, the plugin sends `hint=access_token`.",
+              "type": "string",
+              "required": false,
+              "default": "access_token"
+            }
+          },
+          {
+            "access_token_introspection_jwt_claim": {
+              "description": "If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (`JSON`). If the key cannot be found, the plugin responds with `401 Unauthorized`. Also if the key is found but cannot be decoded as JWT, it also responds with `401 Unauthorized`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "access_token_introspection_scopes_required": {
+              "description": "Specify the required values (or scopes) that are checked by an introspection claim/property specified by `config.access_token_introspection_scopes_claim`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "access_token_introspection_scopes_claim": {
+              "description": "Specify the claim/property in access token introspection results (`JSON`) to be verified against values of `config.access_token_introspection_scopes_required`. This supports nested claims. For example, with Keycloak you could use `[ \"realm_access\", \"roles\" ]`, hich can be given as `realm_access,roles` (form post). If the claim is not found in access token introspection results, and you have specified `config.access_token_introspection_scopes_required`, the plugin responds with `403 Forbidden`.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "scope"
+              ]
+            }
+          },
+          {
+            "access_token_introspection_consumer_claim": {
+              "description": "When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as `sub` or `username`) in access token introspection results to the Kong consumer entity.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "access_token_introspection_consumer_by": {
+              "description": "When the plugin tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "id",
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "access_token_introspection_leeway": {
+              "description": "Adjusts clock skew between the token issuer introspection results and Kong. The value is added to introspection results (`JSON`) `exp` claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection `expiry` verification altogether with `config.verify_access_token_introspection_expiry`.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "access_token_introspection_timeout": {
+              "description": "Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the `config.access_token_introspection_timeout` on access token introspection.",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "access_token_signing_algorithm": {
+              "description": "When this plugin sets the upstream header as specified with `config.access_token_upstream_header`, re-signs the original access token using the private keys of the JWT Signer plugin. Specify the algorithm that is used to sign the token. The `config.access_token_issuer` specifies which `keyset` is used to sign the new token issued by Kong using the specified signing algorithm.",
+              "type": "string",
+              "one_of": [
+                "HS256",
+                "HS384",
+                "HS512",
+                "RS256",
+                "RS512",
+                "ES256",
+                "ES384",
+                "ES512",
+                "PS256",
+                "PS384",
+                "PS512",
+                "EdDSA"
+              ],
+              "required": true,
+              "default": "RS256"
+            }
+          },
+          {
+            "add_access_token_claims": {
+              "description": "Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.",
+              "type": "map",
+              "values": {
+                "type": "string"
+              },
+              "required": false,
+              "keys": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "set_access_token_claims": {
+              "description": "Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.",
+              "type": "map",
+              "values": {
+                "type": "string"
+              },
+              "required": false,
+              "keys": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "remove_access_token_claims": {
+              "description": "remove claims. It should be an array, and each element is a claim key string.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "original_access_token_upstream_header": {
+              "description": "The HTTP header name used to store the original access token.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "access_token_optional": {
+              "description": "If an access token is not provided or no `config.access_token_request_header` is specified, the plugin cannot verify the access token. In that case, the plugin normally responds with `401 Unauthorized` (client didn't send a token) or `500 Unexpected` (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "verify_access_token_signature": {
+              "description": "Quickly turn access token signature verification off and on as needed.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_access_token_expiry": {
+              "description": "Quickly turn access token expiry verification off and on as needed.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_access_token_scopes": {
+              "description": "Quickly turn off and on the access token required scopes verification, specified with `config.access_token_scopes_required`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_access_token_introspection_expiry": {
+              "description": "Quickly turn access token introspection expiry verification off and on as needed.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_access_token_introspection_scopes": {
+              "description": "Quickly turn off and on the access token introspection scopes verification, specified with `config.access_token_introspection_scopes_required`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "cache_access_token_introspection": {
+              "description": "Whether to cache access token introspection results.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "trust_access_token_introspection": {
+              "description": "Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to `true`, the expiry or scopes are not checked on a payload.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "enable_access_token_introspection": {
+              "description": "If you don't want to support opaque access tokens, change this configuration parameter to `false` to disable introspection.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "channel_token_issuer": {
+              "description": "The `iss` claim of the re-signed channel token is set to this value, which is `kong` by default. The original `iss` claim of the incoming token (possibly introspected) is stored in the `original_iss` claim of the newly signed channel token.",
+              "type": "string",
+              "required": false,
+              "default": "kong"
+            }
+          },
+          {
+            "channel_token_keyset": {
+              "description": "The name of the keyset containing signing keys.",
+              "type": "string",
+              "required": false,
+              "default": "kong"
+            }
+          },
+          {
+            "channel_token_keyset_client_username": {
+              "description": "The client username that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_password`",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "channel_token_keyset_client_password": {
+              "description": "The client password that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_username`",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "channel_token_keyset_client_certificate": {
+              "description": "The client certificate that will be used to authenticate Kong if `channel_token_keyset` is an https uri that requires mTLS Auth.",
+              "reference": "certificates",
+              "type": "foreign",
+              "required": false
+            }
+          },
+          {
+            "channel_token_keyset_rotate_period": {
+              "description": "Specify the period (in seconds) to auto-rotate the jwks for `channel_token_keyset`. The default value 0 means no auto-rotation.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "channel_token_jwks_uri": {
+              "description": "If you want to use `config.verify_channel_token_signature`, you must specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the plugin, then the plugin responds with `401 Unauthorized`.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "channel_token_jwks_uri_client_username": {
+              "description": "The client username that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_password`",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "channel_token_jwks_uri_client_password": {
+              "description": "The client password that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_username`",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "channel_token_jwks_uri_client_certificate": {
+              "description": "The client certificate that will be used to authenticate Kong if `access_token_jwks_uri` is an https uri that requires mTLS Auth.",
+              "reference": "certificates",
+              "type": "foreign",
+              "required": false
+            }
+          },
+          {
+            "channel_token_jwks_uri_rotate_period": {
+              "description": "Specify the period (in seconds) to auto-rotate the jwks for `channel_token_jwks_uri`. The default value 0 means no auto-rotation.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "channel_token_request_header": {
+              "description": "This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to `null` or `\"\"` (empty string).",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "channel_token_leeway": {
+              "description": "Adjusts clock skew between the token issuer and Kong. The value will be added to token's `exp` claim before checking token expiry against Kong servers current time in seconds. You can disable channel token `expiry` verification altogether with `config.verify_channel_token_expiry`.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "channel_token_scopes_required": {
+              "description": "Specify the required values (or scopes) that are checked by a claim specified by `config.channel_token_scopes_claim`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_scopes_claim": {
+              "description": "Specify the claim in a channel token to verify against values of `config.channel_token_scopes_required`. This supports nested claims.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "scope"
+              ]
+            }
+          },
+          {
+            "channel_token_consumer_claim": {
+              "description": "When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an `id`, a `username`, and a `custom_id`. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the plugin responds with `403 Forbidden`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_consumer_by": {
+              "description": "When the plugin tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: `id`, `username`, and `custom_id`.",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "id",
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "channel_token_upstream_header": {
+              "description": "This plugin removes the `config.channel_token_request_header` from the request after reading its value.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "channel_token_upstream_leeway": {
+              "description": "If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's `exp` claim.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "channel_token_introspection_endpoint": {
+              "description": "When you use `opaque` access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the plugin does not try introspection and returns `401 Unauthorized` instead.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "channel_token_introspection_authorization": {
+              "description": "When using `opaque` channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the plugin will not try introspection, and instead returns `401 Unauthorized` when using opaque channel tokens.",
+              "type": "string",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_introspection_body_args": {
+              "description": "If you need to pass additional body arguments to introspection endpoint when the plugin introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: `resource=` or `a=1&b=&c`.",
+              "type": "string",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_introspection_hint": {
+              "description": "If you need to give `hint` parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a `hint` isn't sent with channel token introspection.",
+              "type": "string",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_introspection_jwt_claim": {
+              "description": "If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (`JSON`), the plugin can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_introspection_scopes_required": {
+              "description": "Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by `config.channel_token_introspection_scopes_claim`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_introspection_scopes_claim": {
+              "description": "Use this parameter to specify the claim/property in channel token introspection results (`JSON`) to be verified against values of `config.channel_token_introspection_scopes_required`. This supports nested claims.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "scope"
+              ]
+            }
+          },
+          {
+            "channel_token_introspection_consumer_claim": {
+              "description": "When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as `sub` or `username`) in channel token introspection results to Kong consumer entity",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "channel_token_introspection_consumer_by": {
+              "description": "When the plugin tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are `id`, `username` and `custom_id`.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "id",
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "channel_token_introspection_leeway": {
+              "description": "You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be added to introspection results (`JSON`) `exp` claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection `expiry` verification altogether with `config.verify_channel_token_introspection_expiry`.",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "channel_token_introspection_timeout": {
+              "description": "Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the `config.access_token_introspection_timeout` on channel token introspection.",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "channel_token_signing_algorithm": {
+              "description": "When this plugin sets the upstream header as specified with `config.channel_token_upstream_header`, it also re-signs the original channel token using private keys of this plugin. Specify the algorithm that is used to sign the token.",
+              "type": "string",
+              "one_of": [
+                "HS256",
+                "HS384",
+                "HS512",
+                "RS256",
+                "RS512",
+                "ES256",
+                "ES384",
+                "ES512",
+                "PS256",
+                "PS384",
+                "PS512",
+                "EdDSA"
+              ],
+              "required": true,
+              "default": "RS256"
+            }
+          },
+          {
+            "add_channel_token_claims": {
+              "description": "Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.",
+              "type": "map",
+              "values": {
+                "type": "string"
+              },
+              "required": false,
+              "keys": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "set_channel_token_claims": {
+              "description": "Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.",
+              "type": "map",
+              "values": {
+                "type": "string"
+              },
+              "required": false,
+              "keys": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "remove_channel_token_claims": {
+              "description": "remove claims. It should be an array, and each element is a claim key string.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "original_channel_token_upstream_header": {
+              "description": "The HTTP header name used to store the original channel token.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "channel_token_optional": {
+              "description": "If a channel token is not provided or no `config.channel_token_request_header` is specified, the plugin cannot verify the channel token. In that case, the plugin normally responds with `401 Unauthorized` (client didn't send a token) or `500 Unexpected` (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "verify_channel_token_signature": {
+              "description": "Quickly turn on/off the channel token signature verification.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_channel_token_expiry": {
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_channel_token_scopes": {
+              "description": "Quickly turn on/off the channel token required scopes verification specified with `config.channel_token_scopes_required`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_channel_token_introspection_expiry": {
+              "description": "Quickly turn on/off the channel token introspection expiry verification.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_channel_token_introspection_scopes": {
+              "description": "Quickly turn on/off the channel token introspection scopes verification specified with `config.channel_token_introspection_scopes_required`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "cache_channel_token_introspection": {
+              "description": "Whether to cache channel token introspection results.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "trust_channel_token_introspection": {
+              "description": "Providing an opaque channel token for plugin introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the plugin signs a new token. This also applies when using a JWT token with introspection JSON as per config.channel_token_introspection_jwt_claim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "enable_channel_token_introspection": {
+              "description": "If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to `false`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "add_claims": {
+              "description": "Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.",
+              "type": "map",
+              "values": {
+                "type": "string"
+              },
+              "required": false,
+              "keys": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "set_claims": {
+              "description": "Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.",
+              "type": "map",
+              "values": {
+                "type": "string"
+              },
+              "required": false,
+              "keys": {
+                "type": "string"
+              },
+              "default": []
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/jwt/3.12.json b/schemas/jwt/3.12.json
new file mode 100644
index 00000000..64ea19b8
--- /dev/null
+++ b/schemas/jwt/3.12.json
@@ -0,0 +1,158 @@
+{
+  "entity_checks": [
+    {
+      "conditional": {
+        "then_field": "config.claims_to_verify",
+        "if_match": {
+          "gt": 0
+        },
+        "then_match": {
+          "contains": "exp"
+        },
+        "if_field": "config.maximum_expiration"
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "uri_param_names": {
+              "description": "A list of querystring parameters that Kong will inspect to retrieve JWTs.",
+              "type": "set",
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "jwt"
+              ]
+            }
+          },
+          {
+            "cookie_names": {
+              "description": "A list of cookie names that Kong will inspect to retrieve JWTs.",
+              "type": "set",
+              "elements": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "key_claim_name": {
+              "description": "The name of the claim in which the key identifying the secret must be passed. The plugin will attempt to read this claim from the JWT payload and the header, in that order.",
+              "type": "string",
+              "default": "iss"
+            }
+          },
+          {
+            "secret_is_base64": {
+              "description": "If true, the plugin assumes the credential’s secret to be base64 encoded. You will need to create a base64-encoded secret for your Consumer, and sign your JWT with the original secret.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "claims_to_verify": {
+              "description": "A list of registered claims (according to RFC 7519) that Kong can verify as well. Accepted values: one of exp or nbf.",
+              "type": "set",
+              "elements": {
+                "one_of": [
+                  "exp",
+                  "nbf"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails.",
+              "type": "string"
+            }
+          },
+          {
+            "run_on_preflight": {
+              "description": "A boolean value that indicates whether the plugin should run (and try to authenticate) on OPTIONS preflight requests. If set to false, then OPTIONS requests will always be allowed.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "maximum_expiration": {
+              "description": "A value between 0 and 31536000 (365 days) limiting the lifetime of the JWT to maximum_expiration seconds in the future.",
+              "type": "number",
+              "between": [
+                0,
+                31536000
+              ],
+              "default": 0
+            }
+          },
+          {
+            "header_names": {
+              "description": "A list of HTTP header names that Kong will inspect to retrieve JWTs.",
+              "type": "set",
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "authorization"
+              ]
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/kafka-consume/3.12.json b/schemas/kafka-consume/3.12.json
new file mode 100644
index 00000000..f40bc295
--- /dev/null
+++ b/schemas/kafka-consume/3.12.json
@@ -0,0 +1,444 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "service": {
+        "eq": null,
+        "reference": "services",
+        "description": "A reference to the 'services' table with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "authentication"
+              ]
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "bootstrap_servers": {
+              "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format.",
+              "type": "set",
+              "elements": {
+                "fields": [
+                  {
+                    "host": {
+                      "description": "A string representing a host name, such as example.com.",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "port": {
+                      "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                      "type": "integer",
+                      "between": [
+                        0,
+                        65535
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "required": true
+            }
+          },
+          {
+            "topics": {
+              "description": "The Kafka topics and their configuration you want to consume from.",
+              "type": "array",
+              "len_min": 1,
+              "elements": {
+                "fields": [
+                  {
+                    "name": {
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "schema_registry": {
+                      "description": "The plugin-global schema registry configuration.",
+                      "type": "record",
+                      "fields": [
+                        {
+                          "confluent": {
+                            "type": "record",
+                            "fields": [
+                              {
+                                "url": {
+                                  "description": "The URL of the schema registry.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "ttl": {
+                                  "description": "The TTL in seconds for the schema registry cache.",
+                                  "type": "number",
+                                  "between": [
+                                    0,
+                                    3600
+                                  ]
+                                }
+                              },
+                              {
+                                "ssl_verify": {
+                                  "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.",
+                                  "type": "boolean",
+                                  "default": true
+                                }
+                              },
+                              {
+                                "authentication": {
+                                  "entity_checks": [
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "mode",
+                                          "basic"
+                                        ]
+                                      }
+                                    }
+                                  ],
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "mode": {
+                                        "description": "Authentication mode to use with the schema registry.",
+                                        "type": "string",
+                                        "one_of": [
+                                          "none",
+                                          "basic"
+                                        ],
+                                        "required": true,
+                                        "default": "none"
+                                      }
+                                    },
+                                    {
+                                      "basic": {
+                                        "type": "record",
+                                        "fields": [
+                                          {
+                                            "username": {
+                                              "type": "string",
+                                              "referenceable": true,
+                                              "encrypted": true,
+                                              "required": true
+                                            }
+                                          },
+                                          {
+                                            "password": {
+                                              "type": "string",
+                                              "referenceable": true,
+                                              "encrypted": true,
+                                              "required": true
+                                            }
+                                          }
+                                        ],
+                                        "required": false
+                                      }
+                                    }
+                                  ],
+                                  "required": true
+                                }
+                              }
+                            ],
+                            "required": false
+                          }
+                        }
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "required": true
+            }
+          },
+          {
+            "schema_registry": {
+              "description": "The plugin-global schema registry configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "confluent": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "url": {
+                          "description": "The URL of the schema registry.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "ttl": {
+                          "description": "The TTL in seconds for the schema registry cache.",
+                          "type": "number",
+                          "between": [
+                            0,
+                            3600
+                          ]
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "authentication": {
+                          "entity_checks": [
+                            {
+                              "custom_entity_check": {
+                                "field_sources": [
+                                  "mode",
+                                  "basic"
+                                ]
+                              }
+                            }
+                          ],
+                          "type": "record",
+                          "fields": [
+                            {
+                              "mode": {
+                                "description": "Authentication mode to use with the schema registry.",
+                                "type": "string",
+                                "one_of": [
+                                  "none",
+                                  "basic"
+                                ],
+                                "required": true,
+                                "default": "none"
+                              }
+                            },
+                            {
+                              "basic": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "username": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  },
+                                  {
+                                    "password": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "mode": {
+              "description": "The mode of operation for the plugin.",
+              "type": "string",
+              "one_of": [
+                "server-sent-events",
+                "http-get",
+                "websocket"
+              ],
+              "required": true,
+              "default": "http-get"
+            }
+          },
+          {
+            "message_deserializer": {
+              "description": "The deserializer to use for the consumed messages.",
+              "type": "string",
+              "one_of": [
+                "json",
+                "noop"
+              ],
+              "required": true,
+              "default": "noop"
+            }
+          },
+          {
+            "auto_offset_reset": {
+              "description": "The offset to start from when there is no initial offset in the consumer group.",
+              "type": "string",
+              "one_of": [
+                "earliest",
+                "latest"
+              ],
+              "required": true,
+              "default": "latest"
+            }
+          },
+          {
+            "commit_strategy": {
+              "description": "The strategy to use for committing offsets.",
+              "type": "string",
+              "one_of": [
+                "auto",
+                "off"
+              ],
+              "required": true,
+              "default": "auto"
+            }
+          },
+          {
+            "authentication": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "The authentication strategy for the plugin, the only option for the value is `sasl`.",
+                    "type": "string",
+                    "one_of": [
+                      "sasl"
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "mechanism": {
+                    "description": "The SASL authentication mechanism.  Supported options: `PLAIN` or `SCRAM-SHA-256`.",
+                    "type": "string",
+                    "one_of": [
+                      "PLAIN",
+                      "SCRAM-SHA-256",
+                      "SCRAM-SHA-512"
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "tokenauth": {
+                    "description": "Enable this to indicate `DelegationToken` authentication",
+                    "type": "boolean",
+                    "required": false
+                  }
+                },
+                {
+                  "user": {
+                    "description": "Username for SASL authentication.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password for SASL authentication.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "security": {
+              "type": "record",
+              "fields": [
+                {
+                  "certificate_id": {
+                    "description": "UUID of certificate entity for mTLS authentication.",
+                    "type": "string",
+                    "uuid": true,
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "Enables TLS.",
+                    "type": "boolean",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "cluster_name": {
+              "description": "An identifier for the Kafka cluster.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/kafka-log/3.12.json b/schemas/kafka-log/3.12.json
new file mode 100644
index 00000000..caf691e8
--- /dev/null
+++ b/schemas/kafka-log/3.12.json
@@ -0,0 +1,446 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "authentication"
+              ]
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "bootstrap_servers": {
+              "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format.",
+              "type": "set",
+              "elements": {
+                "fields": [
+                  {
+                    "host": {
+                      "description": "A string representing a host name, such as example.com.",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "port": {
+                      "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                      "type": "integer",
+                      "between": [
+                        0,
+                        65535
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              }
+            }
+          },
+          {
+            "topic": {
+              "description": "The Kafka topic to publish to.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "key_query_arg": {
+              "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "timeout": {
+              "description": "Socket timeout in milliseconds.",
+              "type": "integer",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "type": "integer",
+              "default": 60000
+            }
+          },
+          {
+            "keepalive_enabled": {
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "authentication": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "The authentication strategy for the plugin, the only option for the value is `sasl`.",
+                    "type": "string",
+                    "one_of": [
+                      "sasl"
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "mechanism": {
+                    "description": "The SASL authentication mechanism.  Supported options: `PLAIN`, `SCRAM-SHA-256` or `SCRAM-SHA-512`.",
+                    "type": "string",
+                    "one_of": [
+                      "PLAIN",
+                      "SCRAM-SHA-256",
+                      "SCRAM-SHA-512"
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "tokenauth": {
+                    "description": "Enable this to indicate `DelegationToken` authentication",
+                    "type": "boolean",
+                    "required": false
+                  }
+                },
+                {
+                  "user": {
+                    "description": "Username for SASL authentication.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password for SASL authentication.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true,
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "schema_registry": {
+              "description": "The plugin-global schema registry configuration. This can be overwritten by the topic configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "confluent": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "url": {
+                          "description": "The URL of the schema registry.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "ttl": {
+                          "description": "The TTL in seconds for the schema registry cache.",
+                          "type": "number",
+                          "between": [
+                            0,
+                            3600
+                          ]
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "authentication": {
+                          "entity_checks": [
+                            {
+                              "custom_entity_check": {
+                                "field_sources": [
+                                  "mode",
+                                  "basic"
+                                ]
+                              }
+                            }
+                          ],
+                          "type": "record",
+                          "fields": [
+                            {
+                              "mode": {
+                                "description": "Authentication mode to use with the schema registry.",
+                                "type": "string",
+                                "one_of": [
+                                  "none",
+                                  "basic"
+                                ],
+                                "required": true,
+                                "default": "none"
+                              }
+                            },
+                            {
+                              "basic": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "username": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  },
+                                  {
+                                    "password": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "value_schema": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "subject_name": {
+                                "description": "The name of the subject",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "schema_version": {
+                                "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version.",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be either 'latest' or a positive integer",
+                                  "patterns": [
+                                    "^latest$",
+                                    "^[0-9]+$"
+                                  ]
+                                },
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "key_schema": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "subject_name": {
+                                "description": "The name of the subject",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "schema_version": {
+                                "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version.",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be either 'latest' or a positive integer",
+                                  "patterns": [
+                                    "^latest$",
+                                    "^[0-9]+$"
+                                  ]
+                                },
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "security": {
+              "type": "record",
+              "fields": [
+                {
+                  "certificate_id": {
+                    "description": "UUID of certificate entity for mTLS authentication.",
+                    "type": "string",
+                    "uuid": true,
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "Enables TLS.",
+                    "type": "boolean",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "cluster_name": {
+              "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier.  If more than one Kafka plugin is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these plugins will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster.",
+              "type": "string",
+              "auto": true,
+              "required": false
+            }
+          },
+          {
+            "producer_request_acks": {
+              "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).",
+              "type": "integer",
+              "one_of": [
+                -1,
+                0,
+                1
+              ],
+              "default": 1
+            }
+          },
+          {
+            "producer_request_timeout": {
+              "description": "Time to wait for a Produce response in milliseconds",
+              "type": "integer",
+              "default": 2000
+            }
+          },
+          {
+            "producer_request_limits_messages_per_request": {
+              "description": "Maximum number of messages to include into a single Produce request.",
+              "type": "integer",
+              "default": 200
+            }
+          },
+          {
+            "producer_request_limits_bytes_per_request": {
+              "description": "Maximum size of a Produce request in bytes.",
+              "type": "integer",
+              "default": 1048576
+            }
+          },
+          {
+            "producer_request_retries_max_attempts": {
+              "description": "Maximum number of retry attempts per single Produce request.",
+              "type": "integer",
+              "default": 10
+            }
+          },
+          {
+            "producer_request_retries_backoff_timeout": {
+              "description": "Backoff interval between retry attempts in milliseconds.",
+              "type": "integer",
+              "default": 100
+            }
+          },
+          {
+            "producer_async": {
+              "description": "Flag to enable asynchronous mode.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "producer_async_flush_timeout": {
+              "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.",
+              "type": "integer",
+              "default": 1000
+            }
+          },
+          {
+            "producer_async_buffering_limits_messages_in_memory": {
+              "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.",
+              "type": "integer",
+              "default": 50000
+            }
+          },
+          {
+            "custom_fields_by_lua": {
+              "keys": {
+                "type": "string",
+                "len_min": 1
+              },
+              "type": "map",
+              "values": {
+                "type": "string",
+                "len_min": 1
+              },
+              "description": "Lua code as a key-value map"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/kafka-upstream/3.12.json b/schemas/kafka-upstream/3.12.json
new file mode 100644
index 00000000..5f6438d1
--- /dev/null
+++ b/schemas/kafka-upstream/3.12.json
@@ -0,0 +1,495 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "forward_method",
+                "forward_uri",
+                "forward_headers",
+                "forward_body"
+              ]
+            }
+          },
+          {
+            "custom_entity_check": {
+              "field_sources": [
+                "authentication"
+              ]
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "bootstrap_servers": {
+              "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format.",
+              "type": "set",
+              "elements": {
+                "fields": [
+                  {
+                    "host": {
+                      "description": "A string representing a host name, such as example.com.",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "port": {
+                      "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                      "type": "integer",
+                      "between": [
+                        0,
+                        65535
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              }
+            }
+          },
+          {
+            "schema_registry": {
+              "description": "The plugin-global schema registry configuration. This can be overwritten by the topic configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "confluent": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "url": {
+                          "description": "The URL of the schema registry.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "ttl": {
+                          "description": "The TTL in seconds for the schema registry cache.",
+                          "type": "number",
+                          "between": [
+                            0,
+                            3600
+                          ]
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "authentication": {
+                          "entity_checks": [
+                            {
+                              "custom_entity_check": {
+                                "field_sources": [
+                                  "mode",
+                                  "basic"
+                                ]
+                              }
+                            }
+                          ],
+                          "type": "record",
+                          "fields": [
+                            {
+                              "mode": {
+                                "description": "Authentication mode to use with the schema registry.",
+                                "type": "string",
+                                "one_of": [
+                                  "none",
+                                  "basic"
+                                ],
+                                "required": true,
+                                "default": "none"
+                              }
+                            },
+                            {
+                              "basic": {
+                                "type": "record",
+                                "fields": [
+                                  {
+                                    "username": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  },
+                                  {
+                                    "password": {
+                                      "type": "string",
+                                      "referenceable": true,
+                                      "encrypted": true,
+                                      "required": true
+                                    }
+                                  }
+                                ],
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "value_schema": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "subject_name": {
+                                "description": "The name of the subject",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "schema_version": {
+                                "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version.",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be either 'latest' or a positive integer",
+                                  "patterns": [
+                                    "^latest$",
+                                    "^[0-9]+$"
+                                  ]
+                                },
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      },
+                      {
+                        "key_schema": {
+                          "type": "record",
+                          "fields": [
+                            {
+                              "subject_name": {
+                                "description": "The name of the subject",
+                                "type": "string",
+                                "required": false
+                              }
+                            },
+                            {
+                              "schema_version": {
+                                "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version.",
+                                "type": "string",
+                                "match_any": {
+                                  "err": "must be either 'latest' or a positive integer",
+                                  "patterns": [
+                                    "^latest$",
+                                    "^[0-9]+$"
+                                  ]
+                                },
+                                "required": false
+                              }
+                            }
+                          ],
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "topics_query_arg": {
+              "description": "The request query parameter name that contains the topics to publish to",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "allowed_topics": {
+              "description": "The list of allowed topic names to which messages can be sent. The default topic configured in the `topic` field is always allowed, regardless of its inclusion in `allowed_topics`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "topic": {
+              "description": "The default Kafka topic to publish to if the query parameter defined in the `topics_query_arg` does not exist in the request",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "key_query_arg": {
+              "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "timeout": {
+              "description": "Socket timeout in milliseconds.",
+              "type": "integer",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "Keepalive timeout in milliseconds.",
+              "type": "integer",
+              "default": 60000
+            }
+          },
+          {
+            "keepalive_enabled": {
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "authentication": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "The authentication strategy for the plugin, the only option for the value is `sasl`.",
+                    "type": "string",
+                    "one_of": [
+                      "sasl"
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "mechanism": {
+                    "description": "The SASL authentication mechanism.  Supported options: `PLAIN`, `SCRAM-SHA-256`, or `SCRAM-SHA-512`.",
+                    "type": "string",
+                    "one_of": [
+                      "PLAIN",
+                      "SCRAM-SHA-256",
+                      "SCRAM-SHA-512"
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "tokenauth": {
+                    "description": "Enable this to indicate `DelegationToken` authentication.",
+                    "type": "boolean",
+                    "required": false
+                  }
+                },
+                {
+                  "user": {
+                    "description": "Username for SASL authentication.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password for SASL authentication.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "security": {
+              "type": "record",
+              "fields": [
+                {
+                  "certificate_id": {
+                    "description": "UUID of certificate entity for mTLS authentication.",
+                    "type": "string",
+                    "uuid": true,
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "Enables TLS.",
+                    "type": "boolean",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "forward_method": {
+              "description": "Include the request method in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_uri": {
+              "description": "Include the request URI and URI arguments (as in, query arguments) in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_headers": {
+              "description": "Include the request headers in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "forward_body": {
+              "description": "Include the request body in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "message_by_lua_functions": {
+              "description": "The Lua functions that manipulates the message being sent to the Kafka topic.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "cluster_name": {
+              "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier.  If more than one Kafka plugin is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these plugins will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster.",
+              "auto": true,
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "producer_request_acks": {
+              "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).",
+              "type": "integer",
+              "one_of": [
+                -1,
+                0,
+                1
+              ],
+              "default": 1
+            }
+          },
+          {
+            "producer_request_timeout": {
+              "description": "Time to wait for a Produce response in milliseconds.",
+              "type": "integer",
+              "default": 2000
+            }
+          },
+          {
+            "producer_request_limits_messages_per_request": {
+              "description": "Maximum number of messages to include into a single producer request.",
+              "type": "integer",
+              "default": 200
+            }
+          },
+          {
+            "producer_request_limits_bytes_per_request": {
+              "description": "Maximum size of a Produce request in bytes.",
+              "type": "integer",
+              "default": 1048576
+            }
+          },
+          {
+            "producer_request_retries_max_attempts": {
+              "description": "Maximum number of retry attempts per single Produce request.",
+              "type": "integer",
+              "default": 10
+            }
+          },
+          {
+            "producer_request_retries_backoff_timeout": {
+              "description": "Backoff interval between retry attempts in milliseconds.",
+              "type": "integer",
+              "default": 100
+            }
+          },
+          {
+            "producer_async": {
+              "description": "Flag to enable asynchronous mode.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "producer_async_flush_timeout": {
+              "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.",
+              "type": "integer",
+              "default": 1000
+            }
+          },
+          {
+            "producer_async_buffering_limits_messages_in_memory": {
+              "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.",
+              "type": "integer",
+              "default": 50000
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/key-auth-enc/3.12.json b/schemas/key-auth-enc/3.12.json
new file mode 100644
index 00000000..71d65e0f
--- /dev/null
+++ b/schemas/key-auth-enc/3.12.json
@@ -0,0 +1,116 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "key_names": {
+              "description": "Describes an array of parameter names where the plugin will look for a key. The client must send the authentication key in one of those key names, and the plugin will try to read the credential from a header, request body, or query string parameter with the same name.  Key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "description": "A string representing an HTTP header name.",
+                "type": "string"
+              },
+              "default": [
+                "apikey"
+              ]
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to show or hide the credential from the upstream service. If `true`, the plugin strips the credential from the request (i.e., the header, query string, or request body containing the key) before proxying it.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string"
+            }
+          },
+          {
+            "key_in_header": {
+              "description": "If enabled (default), the plugin reads the request header and tries to find the key in it.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "key_in_query": {
+              "description": "If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "key_in_body": {
+              "description": "If enabled, the plugin reads the request body (if said request has one and its MIME type is supported) and tries to find the key in it. Supported MIME types: `application/www-form-urlencoded`, `application/json`, and `multipart/form-data`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "run_on_preflight": {
+              "description": "A boolean value that indicates whether the plugin should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests are always allowed.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/key-auth/3.12.json b/schemas/key-auth/3.12.json
new file mode 100644
index 00000000..8fa4ce79
--- /dev/null
+++ b/schemas/key-auth/3.12.json
@@ -0,0 +1,201 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "key_names": {
+              "description": "Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "description": "A string representing an HTTP header name.",
+                "type": "string"
+              },
+              "default": [
+                "apikey"
+              ]
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to show or hide the credential from the upstream service. If `true`, the plugin strips the credential from the request.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`.",
+              "type": "string"
+            }
+          },
+          {
+            "key_in_header": {
+              "description": "If enabled (default), the plugin reads the request header and tries to find the key in it.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "key_in_query": {
+              "description": "If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "key_in_body": {
+              "description": "If enabled, the plugin reads the request body. Supported MIME types: `application/www-form-urlencoded`, `application/json`, and `multipart/form-data`.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "run_on_preflight": {
+              "description": "A boolean value that indicates whether the plugin should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests are always allowed.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "identity_realms": {
+              "description": "A configuration of Konnect Identity Realms that indicate where to source a consumer from.",
+              "type": "set",
+              "elements": {
+                "entity_checks": [
+                  {
+                    "conditional": {
+                      "then_field": "id",
+                      "if_match": {
+                        "eq": "realm"
+                      },
+                      "then_match": {
+                        "required": true
+                      },
+                      "if_field": "scope"
+                    }
+                  },
+                  {
+                    "conditional": {
+                      "then_field": "id",
+                      "if_match": {
+                        "eq": "cp"
+                      },
+                      "then_match": {
+                        "eq": null,
+                        "required": false
+                      },
+                      "if_field": "scope"
+                    }
+                  },
+                  {
+                    "conditional": {
+                      "then_field": "region",
+                      "if_match": {
+                        "eq": "cp"
+                      },
+                      "then_match": {
+                        "eq": null,
+                        "required": false
+                      },
+                      "if_field": "scope"
+                    }
+                  }
+                ],
+                "type": "record",
+                "fields": [
+                  {
+                    "scope": {
+                      "one_of": [
+                        "cp",
+                        "realm"
+                      ],
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "id": {
+                      "description": "A string representing a UUID (universally unique identifier).",
+                      "auto": false,
+                      "uuid": true,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "region": {
+                      "type": "string"
+                    }
+                  }
+                ]
+              },
+              "default": [
+                {
+                  "scope": "cp",
+                  "id": null,
+                  "region": null
+                }
+              ]
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/konnect-application-auth/3.12.json b/schemas/konnect-application-auth/3.12.json
new file mode 100644
index 00000000..163eff96
--- /dev/null
+++ b/schemas/konnect-application-auth/3.12.json
@@ -0,0 +1,3263 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [],
+        "type": "record",
+        "fields": [
+          {
+            "key_names": {
+              "description": "The names of the headers containing the API key. You can specify multiple header names.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "description": "A string representing an HTTP header name.",
+                "type": "string"
+              },
+              "default": [
+                "apikey"
+              ]
+            }
+          },
+          {
+            "auth_type": {
+              "description": "The type of authentication to be performed. Possible values are: 'openid-connect', 'key-auth', 'v2-strategies'.",
+              "type": "string",
+              "one_of": [
+                "openid-connect",
+                "key-auth",
+                "v2-strategies"
+              ],
+              "default": "openid-connect",
+              "required": true
+            }
+          },
+          {
+            "scope": {
+              "description": "The unique scope identifier for the plugin configuration.",
+              "unique": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "v2_strategies": {
+              "description": "The map of v2 strategies.",
+              "type": "record",
+              "required": false,
+              "fields": [
+                {
+                  "key_auth": {
+                    "description": "List of key_auth strategies.",
+                    "type": "array",
+                    "elements": {
+                      "fields": [
+                        {
+                          "strategy_id": {
+                            "description": "The strategy id the config is tied to.",
+                            "type": "string",
+                            "required": true
+                          }
+                        },
+                        {
+                          "config": {
+                            "type": "record",
+                            "fields": [
+                              {
+                                "key_names": {
+                                  "description": "The names of the headers containing the API key. You can specify multiple header names.",
+                                  "type": "array",
+                                  "required": true,
+                                  "elements": {
+                                    "description": "A string representing an HTTP header name.",
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "apikey"
+                                  ]
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "openid_connect": {
+                    "description": "List of openid_connect strategies.",
+                    "type": "array",
+                    "elements": {
+                      "fields": [
+                        {
+                          "strategy_id": {
+                            "description": "The strategy id the config is tied to.",
+                            "type": "string",
+                            "required": true
+                          }
+                        },
+                        {
+                          "config": {
+                            "description": "openid-connect plugin configuration.",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "issuer": {
+                                  "description": "The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.",
+                                  "type": "string",
+                                  "required": true
+                                }
+                              },
+                              {
+                                "using_pseudo_issuer": {
+                                  "description": "If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with `config.issuer`.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "discovery_headers_names": {
+                                  "description": "Extra header names passed to the discovery endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "discovery_headers_values": {
+                                  "description": "Extra header values passed to the discovery endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "extra_jwks_uris": {
+                                  "description": "JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).",
+                                  "type": "set",
+                                  "elements": {
+                                    "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "rediscovery_lifetime": {
+                                  "description": "Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 30
+                                }
+                              },
+                              {
+                                "auth_methods": {
+                                  "description": "Types of credentials/grants to enable.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "password",
+                                      "client_credentials",
+                                      "authorization_code",
+                                      "bearer",
+                                      "introspection",
+                                      "userinfo",
+                                      "kong_oauth2",
+                                      "refresh_token",
+                                      "session"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "password",
+                                    "client_credentials",
+                                    "authorization_code",
+                                    "bearer",
+                                    "introspection",
+                                    "userinfo",
+                                    "kong_oauth2",
+                                    "refresh_token",
+                                    "session"
+                                  ]
+                                }
+                              },
+                              {
+                                "client_id": {
+                                  "description": "The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.",
+                                  "type": "array",
+                                  "encrypted": true,
+                                  "elements": {
+                                    "type": "string",
+                                    "referenceable": true
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "client_secret": {
+                                  "description": "The client secret.",
+                                  "type": "array",
+                                  "encrypted": true,
+                                  "elements": {
+                                    "type": "string",
+                                    "referenceable": true
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "client_auth": {
+                                  "description": "The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication).",
+                                  "type": "array",
+                                  "elements": {
+                                    "one_of": [
+                                      "client_secret_basic",
+                                      "client_secret_post",
+                                      "client_secret_jwt",
+                                      "private_key_jwt",
+                                      "tls_client_auth",
+                                      "self_signed_tls_client_auth",
+                                      "none"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "client_jwk": {
+                                  "description": "The JWK used for the private_key_jwt authentication.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "record",
+                                    "fields": [
+                                      {
+                                        "issuer": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "kty": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "use": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "key_ops": {
+                                          "type": "array",
+                                          "elements": {
+                                            "required": false,
+                                            "type": "string"
+                                          },
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "alg": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "kid": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "x5u": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "x5c": {
+                                          "type": "array",
+                                          "elements": {
+                                            "required": false,
+                                            "type": "string"
+                                          },
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "x5t": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "x5t#S256": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "k": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "x": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "y": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "crv": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "n": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "e": {
+                                          "required": false,
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "d": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "p": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "q": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "dp": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "dq": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "qi": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "oth": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "r": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      },
+                                      {
+                                        "t": {
+                                          "referenceable": true,
+                                          "type": "string",
+                                          "encrypted": true,
+                                          "required": false
+                                        }
+                                      }
+                                    ],
+                                    "required": false
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "client_alg": {
+                                  "description": "The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication.",
+                                  "type": "array",
+                                  "elements": {
+                                    "one_of": [
+                                      "HS256",
+                                      "HS384",
+                                      "HS512",
+                                      "RS256",
+                                      "RS384",
+                                      "RS512",
+                                      "ES256",
+                                      "ES384",
+                                      "ES512",
+                                      "PS256",
+                                      "PS384",
+                                      "PS512",
+                                      "EdDSA"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "client_arg": {
+                                  "description": "The client to use for this request (the selection is made with a request parameter with the same name).",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "client_id"
+                                }
+                              },
+                              {
+                                "redirect_uri": {
+                                  "description": "The redirect URI passed to the authorization and token endpoints.",
+                                  "type": "array",
+                                  "elements": {
+                                    "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "login_redirect_uri": {
+                                  "description": "Where to redirect the client when `login_action` is set to `redirect`.",
+                                  "type": "array",
+                                  "elements": {
+                                    "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                                    "referenceable": true,
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "logout_redirect_uri": {
+                                  "description": "Where to redirect the client after the logout.",
+                                  "type": "array",
+                                  "elements": {
+                                    "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                                    "referenceable": true,
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "forbidden_redirect_uri": {
+                                  "description": "Where to redirect the client on forbidden requests.",
+                                  "type": "array",
+                                  "elements": {
+                                    "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "forbidden_error_message": {
+                                  "description": "The error message for the forbidden requests (when not using the redirection).",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "Forbidden"
+                                }
+                              },
+                              {
+                                "forbidden_destroy_session": {
+                                  "description": "Destroy any active session for the forbidden requests.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "unauthorized_destroy_session": {
+                                  "description": "Destroy any active session for the unauthorized requests.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "unauthorized_redirect_uri": {
+                                  "description": "Where to redirect the client on unauthorized requests.",
+                                  "type": "array",
+                                  "elements": {
+                                    "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "unauthorized_error_message": {
+                                  "description": "The error message for the unauthorized requests (when not using the redirection).",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "Unauthorized"
+                                }
+                              },
+                              {
+                                "unexpected_redirect_uri": {
+                                  "description": "Where to redirect the client when unexpected errors happen with the requests.",
+                                  "type": "array",
+                                  "elements": {
+                                    "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "response_mode": {
+                                  "description": "Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "query",
+                                    "form_post",
+                                    "fragment",
+                                    "query.jwt",
+                                    "form_post.jwt",
+                                    "fragment.jwt",
+                                    "jwt"
+                                  ],
+                                  "required": false,
+                                  "default": "query"
+                                }
+                              },
+                              {
+                                "response_type": {
+                                  "description": "The response type passed to the authorization endpoint.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "code"
+                                  ]
+                                }
+                              },
+                              {
+                                "scopes": {
+                                  "description": "The scopes passed to the authorization and token endpoints.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "type": "string",
+                                    "referenceable": true
+                                  },
+                                  "default": [
+                                    "openid"
+                                  ]
+                                }
+                              },
+                              {
+                                "audience": {
+                                  "description": "The audience passed to the authorization endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "issuers_allowed": {
+                                  "description": "The issuers allowed to be present in the tokens (`iss` claim).",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "scopes_required": {
+                                  "description": "The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "scopes_claim": {
+                                  "description": "The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "scope"
+                                  ]
+                                }
+                              },
+                              {
+                                "audience_required": {
+                                  "description": "The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "audience_claim": {
+                                  "description": "The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "aud"
+                                  ]
+                                }
+                              },
+                              {
+                                "groups_required": {
+                                  "description": "The groups (`groups_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "groups_claim": {
+                                  "description": "The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "groups"
+                                  ]
+                                }
+                              },
+                              {
+                                "roles_required": {
+                                  "description": "The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "roles_claim": {
+                                  "description": "The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "roles"
+                                  ]
+                                }
+                              },
+                              {
+                                "domains": {
+                                  "description": "The allowed values for the `hd` claim.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "max_age": {
+                                  "description": "The maximum age (in seconds) compared to the `auth_time` claim.",
+                                  "type": "number",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "authenticated_groups_claim": {
+                                  "description": "The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "pushed_authorization_request_endpoint": {
+                                  "description": "The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "pushed_authorization_request_endpoint_auth_method": {
+                                  "description": "The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+                                  "type": "string",
+                                  "one_of": [
+                                    "client_secret_basic",
+                                    "client_secret_post",
+                                    "client_secret_jwt",
+                                    "private_key_jwt",
+                                    "tls_client_auth",
+                                    "self_signed_tls_client_auth",
+                                    "none"
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "require_pushed_authorization_requests": {
+                                  "description": "Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`).",
+                                  "type": "boolean",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "require_proof_key_for_code_exchange": {
+                                  "description": "Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled).",
+                                  "type": "boolean",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "require_signed_request_object": {
+                                  "description": "Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled).",
+                                  "type": "boolean",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "authorization_endpoint": {
+                                  "description": "The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "authorization_query_args_names": {
+                                  "description": "Extra query argument names passed to the authorization endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "authorization_query_args_values": {
+                                  "description": "Extra query argument values passed to the authorization endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "authorization_query_args_client": {
+                                  "description": "Extra query arguments passed from the client to the authorization endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "authorization_rolling_timeout": {
+                                  "description": "Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 600
+                                }
+                              },
+                              {
+                                "authorization_cookie_name": {
+                                  "description": "The authorization cookie name.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "authorization"
+                                }
+                              },
+                              {
+                                "authorization_cookie_path": {
+                                  "description": "The authorization cookie Path flag.",
+                                  "type": "string",
+                                  "match_none": [
+                                    {
+                                      "pattern": "//",
+                                      "err": "must not have empty segments"
+                                    }
+                                  ],
+                                  "required": false,
+                                  "starts_with": "/",
+                                  "default": "/"
+                                }
+                              },
+                              {
+                                "authorization_cookie_domain": {
+                                  "description": "The authorization cookie Domain flag.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "authorization_cookie_same_site": {
+                                  "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "Strict",
+                                    "Lax",
+                                    "None",
+                                    "Default"
+                                  ],
+                                  "required": false,
+                                  "default": "Default"
+                                }
+                              },
+                              {
+                                "authorization_cookie_http_only": {
+                                  "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "authorization_cookie_secure": {
+                                  "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.",
+                                  "type": "boolean",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "preserve_query_args": {
+                                  "description": "With this parameter, you can preserve request query arguments even when doing authorization code flow.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "token_endpoint": {
+                                  "description": "The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_endpoint_auth_method": {
+                                  "description": "The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+                                  "type": "string",
+                                  "one_of": [
+                                    "client_secret_basic",
+                                    "client_secret_post",
+                                    "client_secret_jwt",
+                                    "private_key_jwt",
+                                    "tls_client_auth",
+                                    "self_signed_tls_client_auth",
+                                    "none"
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_headers_names": {
+                                  "description": "Extra header names passed to the token endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_headers_values": {
+                                  "description": "Extra header values passed to the token endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_headers_client": {
+                                  "description": "Extra headers passed from the client to the token endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_headers_replay": {
+                                  "description": "The names of token endpoint response headers to forward to the downstream client.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_headers_prefix": {
+                                  "description": "Add a prefix to the token endpoint response headers before forwarding them to the downstream client.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_headers_grants": {
+                                  "description": "Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant.",
+                                  "type": "array",
+                                  "elements": {
+                                    "one_of": [
+                                      "password",
+                                      "client_credentials",
+                                      "authorization_code",
+                                      "refresh_token"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_post_args_names": {
+                                  "description": "Extra post argument names passed to the token endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_post_args_values": {
+                                  "description": "Extra post argument values passed to the token endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_post_args_client": {
+                                  "description": "Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header  This parameter can be used with `scope` values, like this:  `config.token_post_args_client=scope`  In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_endpoint": {
+                                  "description": "The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_endpoint_auth_method": {
+                                  "description": "The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+                                  "type": "string",
+                                  "one_of": [
+                                    "client_secret_basic",
+                                    "client_secret_post",
+                                    "client_secret_jwt",
+                                    "private_key_jwt",
+                                    "tls_client_auth",
+                                    "self_signed_tls_client_auth",
+                                    "none"
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_hint": {
+                                  "description": "Introspection hint parameter value passed to the introspection endpoint.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "access_token"
+                                }
+                              },
+                              {
+                                "introspection_check_active": {
+                                  "description": "Check that the introspection response has an `active` claim with a value of `true`.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "introspection_accept": {
+                                  "description": "The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).",
+                                  "type": "string",
+                                  "one_of": [
+                                    "application/json",
+                                    "application/token-introspection+jwt",
+                                    "application/jwt"
+                                  ],
+                                  "required": false,
+                                  "default": "application/json"
+                                }
+                              },
+                              {
+                                "introspection_headers_names": {
+                                  "description": "Extra header names passed to the introspection endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_headers_values": {
+                                  "description": "Extra header values passed to the introspection endpoint.",
+                                  "type": "array",
+                                  "encrypted": true,
+                                  "elements": {
+                                    "type": "string",
+                                    "referenceable": true
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_headers_client": {
+                                  "description": "Extra headers passed from the client to the introspection endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_post_args_names": {
+                                  "description": "Extra post argument names passed to the introspection endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_post_args_values": {
+                                  "description": "Extra post argument values passed to the introspection endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_post_args_client": {
+                                  "description": "Extra post arguments passed from the client to the introspection endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspection_post_args_client_headers": {
+                                  "description": "Extra post arguments passed from the client headers to the introspection endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "introspect_jwt_tokens": {
+                                  "description": "Specifies whether to introspect the JWT access tokens (can be used to check for revocations).",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "revocation_endpoint": {
+                                  "description": "The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "revocation_endpoint_auth_method": {
+                                  "description": "The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+                                  "type": "string",
+                                  "one_of": [
+                                    "client_secret_basic",
+                                    "client_secret_post",
+                                    "client_secret_jwt",
+                                    "private_key_jwt",
+                                    "tls_client_auth",
+                                    "self_signed_tls_client_auth",
+                                    "none"
+                                  ],
+                                  "required": false
+                                }
+                              },
+                              {
+                                "end_session_endpoint": {
+                                  "description": "The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "userinfo_endpoint": {
+                                  "description": "The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "userinfo_accept": {
+                                  "description": "The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).",
+                                  "type": "string",
+                                  "one_of": [
+                                    "application/json",
+                                    "application/jwt"
+                                  ],
+                                  "required": false,
+                                  "default": "application/json"
+                                }
+                              },
+                              {
+                                "userinfo_headers_names": {
+                                  "description": "Extra header names passed to the user info endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "userinfo_headers_values": {
+                                  "description": "Extra header values passed to the user info endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "userinfo_headers_client": {
+                                  "description": "Extra headers passed from the client to the user info endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "userinfo_query_args_names": {
+                                  "description": "Extra query argument names passed to the user info endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "userinfo_query_args_values": {
+                                  "description": "Extra query argument values passed to the user info endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "userinfo_query_args_client": {
+                                  "description": "Extra query arguments passed from the client to the user info endpoint.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "token_exchange_endpoint": {
+                                  "description": "The token exchange endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_secret": {
+                                  "description": "The session secret.",
+                                  "type": "string",
+                                  "encrypted": true,
+                                  "referenceable": true,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_audience": {
+                                  "description": "The session audience, which is the intended target application. For example `\"my-application\"`.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "default"
+                                }
+                              },
+                              {
+                                "session_cookie_name": {
+                                  "description": "The session cookie name.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "session"
+                                }
+                              },
+                              {
+                                "session_remember": {
+                                  "description": "Enables or disables persistent sessions.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "session_remember_cookie_name": {
+                                  "description": "Persistent session cookie name. Use with the `remember` configuration parameter.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "remember"
+                                }
+                              },
+                              {
+                                "session_remember_rolling_timeout": {
+                                  "description": "Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 604800
+                                }
+                              },
+                              {
+                                "session_remember_absolute_timeout": {
+                                  "description": "Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 2592000
+                                }
+                              },
+                              {
+                                "session_idling_timeout": {
+                                  "description": "Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 900
+                                }
+                              },
+                              {
+                                "session_rolling_timeout": {
+                                  "description": "Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 3600
+                                }
+                              },
+                              {
+                                "session_absolute_timeout": {
+                                  "description": "Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 86400
+                                }
+                              },
+                              {
+                                "session_cookie_path": {
+                                  "description": "The session cookie Path flag.",
+                                  "type": "string",
+                                  "match_none": [
+                                    {
+                                      "pattern": "//",
+                                      "err": "must not have empty segments"
+                                    }
+                                  ],
+                                  "required": false,
+                                  "starts_with": "/",
+                                  "default": "/"
+                                }
+                              },
+                              {
+                                "session_cookie_domain": {
+                                  "description": "The session cookie Domain flag.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_cookie_same_site": {
+                                  "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "Strict",
+                                    "Lax",
+                                    "None",
+                                    "Default"
+                                  ],
+                                  "required": false,
+                                  "default": "Lax"
+                                }
+                              },
+                              {
+                                "session_cookie_http_only": {
+                                  "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "session_cookie_secure": {
+                                  "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.",
+                                  "type": "boolean",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_request_headers": {
+                                  "description": "Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout request headers.",
+                                  "type": "set",
+                                  "elements": {
+                                    "one_of": [
+                                      "id",
+                                      "audience",
+                                      "subject",
+                                      "timeout",
+                                      "idling-timeout",
+                                      "rolling-timeout",
+                                      "absolute-timeout"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_response_headers": {
+                                  "description": "Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout response headers.",
+                                  "type": "set",
+                                  "elements": {
+                                    "one_of": [
+                                      "id",
+                                      "audience",
+                                      "subject",
+                                      "timeout",
+                                      "idling-timeout",
+                                      "rolling-timeout",
+                                      "absolute-timeout"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_storage": {
+                                  "description": "The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "cookie",
+                                    "memcache",
+                                    "memcached",
+                                    "redis"
+                                  ],
+                                  "required": false,
+                                  "default": "cookie"
+                                }
+                              },
+                              {
+                                "session_store_metadata": {
+                                  "description": "Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "session_enforce_same_subject": {
+                                  "description": "When set to `true`, audiences are forced to share the same subject.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "session_hash_subject": {
+                                  "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "session_hash_storage_key": {
+                                  "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "session_memcached_prefix": {
+                                  "description": "The memcached session key prefix.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_memcached_socket": {
+                                  "description": "The memcached unix socket path.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "session_memcached_host": {
+                                  "description": "The memcached host.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "session_memcached_port": {
+                                  "description": "The memcached port.",
+                                  "type": "integer",
+                                  "required": false,
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 11211
+                                }
+                              },
+                              {
+                                "redis": {
+                                  "entity_checks": [
+                                    {
+                                      "mutually_required": [
+                                        "host",
+                                        "port"
+                                      ]
+                                    },
+                                    {
+                                      "mutually_required": [
+                                        "sentinel_master",
+                                        "sentinel_role",
+                                        "sentinel_nodes"
+                                      ]
+                                    },
+                                    {
+                                      "mutually_required": [
+                                        "connect_timeout",
+                                        "send_timeout",
+                                        "read_timeout"
+                                      ]
+                                    },
+                                    {
+                                      "conditional": {
+                                        "then_field": "host",
+                                        "if_match": {
+                                          "eq": true
+                                        },
+                                        "then_match": {
+                                          "required": true
+                                        },
+                                        "if_field": "connection_is_proxied"
+                                      }
+                                    },
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "database",
+                                          "connection_is_proxied"
+                                        ],
+                                        "run_with_missing_fields": true
+                                      }
+                                    },
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "cluster_nodes",
+                                          "connection_is_proxied"
+                                        ],
+                                        "run_with_missing_fields": true
+                                      }
+                                    },
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "sentinel_role",
+                                          "connection_is_proxied"
+                                        ],
+                                        "run_with_missing_fields": true
+                                      }
+                                    }
+                                  ],
+                                  "type": "record",
+                                  "shorthand_fields": [
+                                    {
+                                      "timeout": {
+                                        "deprecation": {
+                                          "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                                          "removal_in_version": "4.0",
+                                          "replaced_with": [
+                                            {
+                                              "path": [
+                                                "connect_timeout"
+                                              ]
+                                            },
+                                            {
+                                              "path": [
+                                                "send_timeout"
+                                              ]
+                                            },
+                                            {
+                                              "path": [
+                                                "read_timeout"
+                                              ]
+                                            }
+                                          ]
+                                        },
+                                        "type": "integer"
+                                      }
+                                    },
+                                    {
+                                      "sentinel_addresses": {
+                                        "len_min": 1,
+                                        "type": "array",
+                                        "elements": {
+                                          "type": "string"
+                                        },
+                                        "deprecation": {
+                                          "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                                          "removal_in_version": "4.0",
+                                          "replaced_with": [
+                                            {
+                                              "path": [
+                                                "sentinel_nodes"
+                                              ]
+                                            }
+                                          ]
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "cluster_addresses": {
+                                        "len_min": 1,
+                                        "type": "array",
+                                        "elements": {
+                                          "type": "string"
+                                        },
+                                        "deprecation": {
+                                          "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                                          "removal_in_version": "4.0",
+                                          "replaced_with": [
+                                            {
+                                              "path": [
+                                                "cluster_nodes"
+                                              ]
+                                            }
+                                          ]
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "fields": [
+                                    {
+                                      "host": {
+                                        "description": "A string representing a host name, such as example.com.",
+                                        "type": "string",
+                                        "default": "127.0.0.1"
+                                      }
+                                    },
+                                    {
+                                      "port": {
+                                        "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          65535
+                                        ],
+                                        "default": 6379
+                                      }
+                                    },
+                                    {
+                                      "connect_timeout": {
+                                        "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ],
+                                        "default": 2000
+                                      }
+                                    },
+                                    {
+                                      "send_timeout": {
+                                        "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ],
+                                        "default": 2000
+                                      }
+                                    },
+                                    {
+                                      "read_timeout": {
+                                        "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ],
+                                        "default": 2000
+                                      }
+                                    },
+                                    {
+                                      "username": {
+                                        "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                                        "type": "string",
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "password": {
+                                        "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                                        "type": "string",
+                                        "encrypted": true,
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "sentinel_username": {
+                                        "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                                        "type": "string",
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "sentinel_password": {
+                                        "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                                        "type": "string",
+                                        "encrypted": true,
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "database": {
+                                        "description": "Database to use for the Redis connection when using the `redis` strategy",
+                                        "type": "integer",
+                                        "default": 0
+                                      }
+                                    },
+                                    {
+                                      "keepalive_pool_size": {
+                                        "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                                        "type": "integer",
+                                        "between": [
+                                          1,
+                                          2147483646
+                                        ],
+                                        "default": 256
+                                      }
+                                    },
+                                    {
+                                      "keepalive_backlog": {
+                                        "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ]
+                                      }
+                                    },
+                                    {
+                                      "sentinel_master": {
+                                        "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "sentinel_role": {
+                                        "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                                        "type": "string",
+                                        "one_of": [
+                                          "master",
+                                          "slave",
+                                          "any"
+                                        ]
+                                      }
+                                    },
+                                    {
+                                      "sentinel_nodes": {
+                                        "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                                        "type": "array",
+                                        "len_min": 1,
+                                        "elements": {
+                                          "fields": [
+                                            {
+                                              "host": {
+                                                "description": "A string representing a host name, such as example.com.",
+                                                "type": "string",
+                                                "default": "127.0.0.1",
+                                                "required": true
+                                              }
+                                            },
+                                            {
+                                              "port": {
+                                                "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                                "type": "integer",
+                                                "between": [
+                                                  0,
+                                                  65535
+                                                ],
+                                                "default": 6379
+                                              }
+                                            }
+                                          ],
+                                          "type": "record"
+                                        },
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "cluster_nodes": {
+                                        "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                                        "type": "array",
+                                        "len_min": 1,
+                                        "elements": {
+                                          "fields": [
+                                            {
+                                              "ip": {
+                                                "description": "A string representing a host name, such as example.com.",
+                                                "type": "string",
+                                                "default": "127.0.0.1",
+                                                "required": true
+                                              }
+                                            },
+                                            {
+                                              "port": {
+                                                "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                                "type": "integer",
+                                                "between": [
+                                                  0,
+                                                  65535
+                                                ],
+                                                "default": 6379
+                                              }
+                                            }
+                                          ],
+                                          "type": "record"
+                                        },
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "ssl": {
+                                        "description": "If set to true, uses SSL to connect to Redis.",
+                                        "type": "boolean",
+                                        "default": false,
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "ssl_verify": {
+                                        "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                                        "type": "boolean",
+                                        "default": false,
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "server_name": {
+                                        "description": "A string representing an SNI (server name indication) value for TLS.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "cluster_max_redirections": {
+                                        "description": "Maximum retry attempts for redirection.",
+                                        "type": "integer",
+                                        "required": false,
+                                        "default": 5
+                                      }
+                                    },
+                                    {
+                                      "connection_is_proxied": {
+                                        "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                                        "type": "boolean",
+                                        "default": false,
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "prefix": {
+                                        "description": "The Redis session key prefix.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "socket": {
+                                        "description": "The Redis unix socket path.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    }
+                                  ],
+                                  "required": true
+                                }
+                              },
+                              {
+                                "reverify": {
+                                  "description": "Specifies whether to always verify tokens stored in the session.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "jwt_session_claim": {
+                                  "description": "The claim to match against the JWT session cookie.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "sid"
+                                }
+                              },
+                              {
+                                "jwt_session_cookie": {
+                                  "description": "The name of the JWT session cookie.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "bearer_token_param_type": {
+                                  "description": "Where to look for the bearer token: - `header`: search the `Authorization`, `access-token`, and `x-access-token` HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "header",
+                                      "cookie",
+                                      "query",
+                                      "body"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "header",
+                                    "query",
+                                    "body"
+                                  ]
+                                }
+                              },
+                              {
+                                "bearer_token_cookie_name": {
+                                  "description": "The name of the cookie in which the bearer token is passed.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "client_credentials_param_type": {
+                                  "description": "Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "header",
+                                      "query",
+                                      "body"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "header",
+                                    "query",
+                                    "body"
+                                  ]
+                                }
+                              },
+                              {
+                                "password_param_type": {
+                                  "description": "Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "header",
+                                      "query",
+                                      "body"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "header",
+                                    "query",
+                                    "body"
+                                  ]
+                                }
+                              },
+                              {
+                                "id_token_param_type": {
+                                  "description": "Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "header",
+                                      "query",
+                                      "body"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "header",
+                                    "query",
+                                    "body"
+                                  ]
+                                }
+                              },
+                              {
+                                "id_token_param_name": {
+                                  "description": "The name of the parameter used to pass the id token.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "refresh_token_param_type": {
+                                  "description": "Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "header",
+                                      "query",
+                                      "body"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "header",
+                                    "query",
+                                    "body"
+                                  ]
+                                }
+                              },
+                              {
+                                "refresh_token_param_name": {
+                                  "description": "The name of the parameter used to pass the refresh token.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "refresh_tokens": {
+                                  "description": "Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a `refresh_token` available.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "upstream_headers_claims": {
+                                  "description": "The upstream header claims. Only top level claims are supported.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_headers_names": {
+                                  "description": "The upstream header names for the claim values.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_access_token_header": {
+                                  "description": "The upstream access token header.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "authorization:bearer"
+                                }
+                              },
+                              {
+                                "upstream_access_token_jwk_header": {
+                                  "description": "The upstream access token JWK header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_id_token_header": {
+                                  "description": "The upstream id token header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_id_token_jwk_header": {
+                                  "description": "The upstream id token JWK header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_refresh_token_header": {
+                                  "description": "The upstream refresh token header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_user_info_header": {
+                                  "description": "The upstream user info header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_user_info_jwt_header": {
+                                  "description": "The upstream user info JWT header (in case the user info returns a JWT response).",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_introspection_header": {
+                                  "description": "The upstream introspection header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_introspection_jwt_header": {
+                                  "description": "The upstream introspection JWT header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "upstream_session_id_header": {
+                                  "description": "The upstream session id header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_headers_claims": {
+                                  "description": "The downstream header claims. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_headers_names": {
+                                  "description": "The downstream header names for the claim values.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_access_token_header": {
+                                  "description": "The downstream access token header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_access_token_jwk_header": {
+                                  "description": "The downstream access token JWK header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_id_token_header": {
+                                  "description": "The downstream id token header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_id_token_jwk_header": {
+                                  "description": "The downstream id token JWK header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_refresh_token_header": {
+                                  "description": "The downstream refresh token header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_user_info_header": {
+                                  "description": "The downstream user info header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_user_info_jwt_header": {
+                                  "description": "The downstream user info JWT header (in case the user info returns a JWT response).",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_introspection_header": {
+                                  "description": "The downstream introspection header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_introspection_jwt_header": {
+                                  "description": "The downstream introspection JWT header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "downstream_session_id_header": {
+                                  "description": "The downstream session id header.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "login_methods": {
+                                  "description": "Enable login functionality with specified grants.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "password",
+                                      "client_credentials",
+                                      "authorization_code",
+                                      "bearer",
+                                      "introspection",
+                                      "userinfo",
+                                      "kong_oauth2",
+                                      "refresh_token",
+                                      "session"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "authorization_code"
+                                  ]
+                                }
+                              },
+                              {
+                                "login_action": {
+                                  "description": "What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "upstream",
+                                    "response",
+                                    "redirect"
+                                  ],
+                                  "required": false,
+                                  "default": "upstream"
+                                }
+                              },
+                              {
+                                "login_tokens": {
+                                  "description": "What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "id_token",
+                                      "access_token",
+                                      "refresh_token",
+                                      "tokens",
+                                      "introspection"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "id_token"
+                                  ]
+                                }
+                              },
+                              {
+                                "login_redirect_mode": {
+                                  "description": "Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).",
+                                  "type": "string",
+                                  "one_of": [
+                                    "query",
+                                    "fragment"
+                                  ],
+                                  "required": false,
+                                  "default": "fragment"
+                                }
+                              },
+                              {
+                                "logout_query_arg": {
+                                  "description": "The request query argument that activates the logout.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "logout_post_arg": {
+                                  "description": "The request body argument that activates the logout.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "logout_uri_suffix": {
+                                  "description": "The request URI suffix that activates the logout.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "logout_methods": {
+                                  "description": "The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "POST",
+                                      "GET",
+                                      "DELETE"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "POST",
+                                    "DELETE"
+                                  ]
+                                }
+                              },
+                              {
+                                "logout_revoke": {
+                                  "description": "Revoke tokens as part of the logout.\n\nFor more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "logout_revoke_access_token": {
+                                  "description": "Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "logout_revoke_refresh_token": {
+                                  "description": "Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "consumer_claim": {
+                                  "description": "The claim used for consumer mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "consumer_by": {
+                                  "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "id",
+                                      "username",
+                                      "custom_id"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "username",
+                                    "custom_id"
+                                  ]
+                                }
+                              },
+                              {
+                                "consumer_optional": {
+                                  "description": "Do not terminate the request if consumer mapping fails.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "credential_claim": {
+                                  "description": "The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "default": [
+                                    "sub"
+                                  ]
+                                }
+                              },
+                              {
+                                "anonymous": {
+                                  "description": "An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "run_on_preflight": {
+                                  "description": "Specifies whether to run this plugin on pre-flight (`OPTIONS`) requests.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "leeway": {
+                                  "description": "Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 0
+                                }
+                              },
+                              {
+                                "verify_parameters": {
+                                  "description": "Verify plugin configuration against discovery.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "verify_nonce": {
+                                  "description": "Verify nonce on authorization code flow.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "verify_claims": {
+                                  "description": "Verify tokens for standard claims.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "verify_signature": {
+                                  "description": "Verify signature of tokens.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "ignore_signature": {
+                                  "description": "Skip the token signature verification on certain grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.",
+                                  "type": "array",
+                                  "required": false,
+                                  "elements": {
+                                    "one_of": [
+                                      "password",
+                                      "client_credentials",
+                                      "authorization_code",
+                                      "refresh_token",
+                                      "session",
+                                      "introspection",
+                                      "userinfo"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "default": []
+                                }
+                              },
+                              {
+                                "enable_hs_signatures": {
+                                  "description": "Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "disable_session": {
+                                  "description": "Disable issuing the session cookie with the specified grants.",
+                                  "type": "array",
+                                  "elements": {
+                                    "one_of": [
+                                      "password",
+                                      "client_credentials",
+                                      "authorization_code",
+                                      "bearer",
+                                      "introspection",
+                                      "userinfo",
+                                      "kong_oauth2",
+                                      "refresh_token",
+                                      "session"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cache_ttl": {
+                                  "description": "The default cache ttl in seconds that is used in case the cached object does not specify the expiry.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 3600
+                                }
+                              },
+                              {
+                                "cache_ttl_max": {
+                                  "description": "The maximum cache ttl in seconds (enforced).",
+                                  "type": "number",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cache_ttl_min": {
+                                  "description": "The minimum cache ttl in seconds (enforced).",
+                                  "type": "number",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cache_ttl_neg": {
+                                  "description": "The negative cache ttl in seconds.",
+                                  "type": "number",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cache_ttl_resurrect": {
+                                  "description": "The resurrection ttl in seconds.",
+                                  "type": "number",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cache_tokens": {
+                                  "description": "Cache the token endpoint requests.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "cache_tokens_salt": {
+                                  "description": "Salt used for generating the cache key that is used for caching the token endpoint requests.",
+                                  "type": "string",
+                                  "auto": true,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cache_introspection": {
+                                  "description": "Cache the introspection endpoint requests.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "cache_token_exchange": {
+                                  "description": "Cache the token exchange endpoint requests.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "cache_user_info": {
+                                  "description": "Cache the user info requests.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "search_user_info": {
+                                  "description": "Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "hide_credentials": {
+                                  "description": "Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "http_version": {
+                                  "description": "The HTTP version used for the requests by this plugin: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.",
+                                  "type": "number",
+                                  "default": 1.1,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "http_proxy": {
+                                  "description": "The HTTP proxy.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "http_proxy_authorization": {
+                                  "description": "The HTTP proxy authorization.",
+                                  "type": "string",
+                                  "referenceable": true,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "https_proxy": {
+                                  "description": "The HTTPS proxy.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "https_proxy_authorization": {
+                                  "description": "The HTTPS proxy authorization.",
+                                  "type": "string",
+                                  "referenceable": true,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "no_proxy": {
+                                  "description": "Do not use proxy with these hosts.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "keepalive": {
+                                  "description": "Use keepalive with the HTTP client.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "ssl_verify": {
+                                  "description": "Verify identity provider server certificate. If set to `true`, the plugin uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "timeout": {
+                                  "description": "Network IO timeout in milliseconds.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 10000
+                                }
+                              },
+                              {
+                                "display_errors": {
+                                  "description": "Display errors on failure responses.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "by_username_ignore_case": {
+                                  "description": "If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "resolve_distributed_claims": {
+                                  "description": "Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the plugin explicitly resolves these distributed claims.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "expose_error_code": {
+                                  "description": "Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to `false` to disable.",
+                                  "type": "boolean",
+                                  "default": true
+                                }
+                              },
+                              {
+                                "token_cache_key_include_scope": {
+                                  "description": "Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.",
+                                  "type": "boolean",
+                                  "default": false
+                                }
+                              },
+                              {
+                                "introspection_token_param_name": {
+                                  "description": "Designate token's parameter name for introspection.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "token"
+                                }
+                              },
+                              {
+                                "revocation_token_param_name": {
+                                  "description": "Designate token's parameter name for revocation.",
+                                  "type": "string",
+                                  "required": false,
+                                  "default": "token"
+                                }
+                              },
+                              {
+                                "proof_of_possession_mtls": {
+                                  "description": "Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "off",
+                                    "strict",
+                                    "optional"
+                                  ],
+                                  "default": "off",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "proof_of_possession_auth_methods_validation": {
+                                  "description": "If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "tls_client_auth_cert_id": {
+                                  "description": "ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.",
+                                  "auto": false,
+                                  "type": "string",
+                                  "uuid": true,
+                                  "required": false
+                                }
+                              },
+                              {
+                                "tls_client_auth_ssl_verify": {
+                                  "description": "Verify identity provider server certificate during mTLS client authentication.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": true
+                                }
+                              },
+                              {
+                                "mtls_token_endpoint": {
+                                  "description": "Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "mtls_introspection_endpoint": {
+                                  "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "mtls_revocation_endpoint": {
+                                  "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.",
+                                  "type": "string",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "proof_of_possession_dpop": {
+                                  "description": "Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "off",
+                                    "strict",
+                                    "optional"
+                                  ],
+                                  "default": "off",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "dpop_use_nonce": {
+                                  "description": "Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.",
+                                  "type": "boolean",
+                                  "required": false,
+                                  "default": false
+                                }
+                              },
+                              {
+                                "dpop_proof_lifetime": {
+                                  "description": "Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.",
+                                  "type": "number",
+                                  "required": false,
+                                  "default": 300
+                                }
+                              },
+                              {
+                                "claims_forbidden": {
+                                  "description": "If given, these claims are forbidden in the token payload.",
+                                  "type": "array",
+                                  "elements": {
+                                    "type": "string"
+                                  },
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cluster_cache_strategy": {
+                                  "description": "The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.",
+                                  "type": "string",
+                                  "one_of": [
+                                    "off",
+                                    "redis"
+                                  ],
+                                  "default": "off",
+                                  "required": false
+                                }
+                              },
+                              {
+                                "cluster_cache_redis": {
+                                  "entity_checks": [
+                                    {
+                                      "mutually_required": [
+                                        "host",
+                                        "port"
+                                      ]
+                                    },
+                                    {
+                                      "mutually_required": [
+                                        "sentinel_master",
+                                        "sentinel_role",
+                                        "sentinel_nodes"
+                                      ]
+                                    },
+                                    {
+                                      "mutually_required": [
+                                        "connect_timeout",
+                                        "send_timeout",
+                                        "read_timeout"
+                                      ]
+                                    },
+                                    {
+                                      "conditional": {
+                                        "then_field": "host",
+                                        "if_match": {
+                                          "eq": true
+                                        },
+                                        "then_match": {
+                                          "required": true
+                                        },
+                                        "if_field": "connection_is_proxied"
+                                      }
+                                    },
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "database",
+                                          "connection_is_proxied"
+                                        ],
+                                        "run_with_missing_fields": true
+                                      }
+                                    },
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "cluster_nodes",
+                                          "connection_is_proxied"
+                                        ],
+                                        "run_with_missing_fields": true
+                                      }
+                                    },
+                                    {
+                                      "custom_entity_check": {
+                                        "field_sources": [
+                                          "sentinel_role",
+                                          "connection_is_proxied"
+                                        ],
+                                        "run_with_missing_fields": true
+                                      }
+                                    }
+                                  ],
+                                  "type": "record",
+                                  "shorthand_fields": [
+                                    {
+                                      "timeout": {
+                                        "deprecation": {
+                                          "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                                          "removal_in_version": "4.0",
+                                          "replaced_with": [
+                                            {
+                                              "path": [
+                                                "connect_timeout"
+                                              ]
+                                            },
+                                            {
+                                              "path": [
+                                                "send_timeout"
+                                              ]
+                                            },
+                                            {
+                                              "path": [
+                                                "read_timeout"
+                                              ]
+                                            }
+                                          ]
+                                        },
+                                        "type": "integer"
+                                      }
+                                    },
+                                    {
+                                      "sentinel_addresses": {
+                                        "len_min": 1,
+                                        "type": "array",
+                                        "elements": {
+                                          "type": "string"
+                                        },
+                                        "deprecation": {
+                                          "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                                          "removal_in_version": "4.0",
+                                          "replaced_with": [
+                                            {
+                                              "path": [
+                                                "sentinel_nodes"
+                                              ]
+                                            }
+                                          ]
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "cluster_addresses": {
+                                        "len_min": 1,
+                                        "type": "array",
+                                        "elements": {
+                                          "type": "string"
+                                        },
+                                        "deprecation": {
+                                          "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                                          "removal_in_version": "4.0",
+                                          "replaced_with": [
+                                            {
+                                              "path": [
+                                                "cluster_nodes"
+                                              ]
+                                            }
+                                          ]
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "fields": [
+                                    {
+                                      "host": {
+                                        "description": "A string representing a host name, such as example.com.",
+                                        "type": "string",
+                                        "default": "127.0.0.1"
+                                      }
+                                    },
+                                    {
+                                      "port": {
+                                        "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          65535
+                                        ],
+                                        "default": 6379
+                                      }
+                                    },
+                                    {
+                                      "connect_timeout": {
+                                        "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ],
+                                        "default": 2000
+                                      }
+                                    },
+                                    {
+                                      "send_timeout": {
+                                        "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ],
+                                        "default": 2000
+                                      }
+                                    },
+                                    {
+                                      "read_timeout": {
+                                        "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ],
+                                        "default": 2000
+                                      }
+                                    },
+                                    {
+                                      "username": {
+                                        "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                                        "type": "string",
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "password": {
+                                        "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                                        "type": "string",
+                                        "encrypted": true,
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "sentinel_username": {
+                                        "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                                        "type": "string",
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "sentinel_password": {
+                                        "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                                        "type": "string",
+                                        "encrypted": true,
+                                        "referenceable": true
+                                      }
+                                    },
+                                    {
+                                      "database": {
+                                        "description": "Database to use for the Redis connection when using the `redis` strategy",
+                                        "type": "integer",
+                                        "default": 0
+                                      }
+                                    },
+                                    {
+                                      "keepalive_pool_size": {
+                                        "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                                        "type": "integer",
+                                        "between": [
+                                          1,
+                                          2147483646
+                                        ],
+                                        "default": 256
+                                      }
+                                    },
+                                    {
+                                      "keepalive_backlog": {
+                                        "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ]
+                                      }
+                                    },
+                                    {
+                                      "sentinel_master": {
+                                        "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "sentinel_role": {
+                                        "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                                        "type": "string",
+                                        "one_of": [
+                                          "master",
+                                          "slave",
+                                          "any"
+                                        ]
+                                      }
+                                    },
+                                    {
+                                      "sentinel_nodes": {
+                                        "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                                        "type": "array",
+                                        "len_min": 1,
+                                        "elements": {
+                                          "fields": [
+                                            {
+                                              "host": {
+                                                "description": "A string representing a host name, such as example.com.",
+                                                "type": "string",
+                                                "required": true,
+                                                "default": "127.0.0.1"
+                                              }
+                                            },
+                                            {
+                                              "port": {
+                                                "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                                "type": "integer",
+                                                "between": [
+                                                  0,
+                                                  65535
+                                                ],
+                                                "default": 6379
+                                              }
+                                            }
+                                          ],
+                                          "type": "record"
+                                        },
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "cluster_nodes": {
+                                        "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                                        "type": "array",
+                                        "len_min": 1,
+                                        "elements": {
+                                          "fields": [
+                                            {
+                                              "ip": {
+                                                "description": "A string representing a host name, such as example.com.",
+                                                "type": "string",
+                                                "required": true,
+                                                "default": "127.0.0.1"
+                                              }
+                                            },
+                                            {
+                                              "port": {
+                                                "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                                "type": "integer",
+                                                "between": [
+                                                  0,
+                                                  65535
+                                                ],
+                                                "default": 6379
+                                              }
+                                            }
+                                          ],
+                                          "type": "record"
+                                        },
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "ssl": {
+                                        "description": "If set to true, uses SSL to connect to Redis.",
+                                        "type": "boolean",
+                                        "required": false,
+                                        "default": false
+                                      }
+                                    },
+                                    {
+                                      "ssl_verify": {
+                                        "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                                        "type": "boolean",
+                                        "required": false,
+                                        "default": false
+                                      }
+                                    },
+                                    {
+                                      "server_name": {
+                                        "description": "A string representing an SNI (server name indication) value for TLS.",
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "cluster_max_redirections": {
+                                        "description": "Maximum retry attempts for redirection.",
+                                        "type": "integer",
+                                        "default": 5,
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "connection_is_proxied": {
+                                        "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                                        "type": "boolean",
+                                        "required": false,
+                                        "default": false
+                                      }
+                                    }
+                                  ],
+                                  "required": true
+                                }
+                              }
+                            ]
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                }
+              ],
+              "default": []
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ldap-auth-advanced/3.12.json b/schemas/ldap-auth-advanced/3.12.json
new file mode 100644
index 00000000..bf37bddc
--- /dev/null
+++ b/schemas/ldap-auth-advanced/3.12.json
@@ -0,0 +1,243 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "ldap_host": {
+              "description": "Host on which the LDAP server is running.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "ldap_password": {
+              "description": "The password to the LDAP server.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true
+            }
+          },
+          {
+            "ldap_port": {
+              "description": "TCP port where the LDAP server is listening. 389 is the default port for non-SSL LDAP and AD. 636 is the port required for SSL LDAP and AD. If `ldaps` is configured, you must use port 636.",
+              "type": "number",
+              "default": 389
+            }
+          },
+          {
+            "bind_dn": {
+              "description": "The DN to bind to. Used to perform LDAP search of user. This `bind_dn` should have permissions to search for the user being authenticated.",
+              "type": "string",
+              "referenceable": true
+            }
+          },
+          {
+            "ldaps": {
+              "description": "Set it to `true` to use `ldaps`, a secure protocol (that can be configured to TLS) to connect to the LDAP server. When `ldaps` is configured, you must use port 636. If the `ldap` setting is enabled, ensure the `start_tls` setting is disabled.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "start_tls": {
+              "description": "Set it to `true` to issue StartTLS (Transport Layer Security) extended operation over `ldap` connection. If the `start_tls` setting is enabled, ensure the `ldaps` setting is disabled.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "verify_ldap_host": {
+              "description": "Set to `true` to authenticate LDAP server. The server certificate will be verified according to the CA certificates specified by the `lua_ssl_trusted_certificate` directive.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "base_dn": {
+              "description": "Base DN as the starting point for the search; e.g., 'dc=example,dc=com'.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "attribute": {
+              "description": "Attribute to be used to search the user; e.g., \"cn\".",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "Cache expiry time in seconds.",
+              "type": "number",
+              "default": 60,
+              "required": true
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to hide the credential to the upstream server. It will be removed by Kong before proxying the request.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "timeout": {
+              "description": "An optional timeout in milliseconds when waiting for connection with LDAP server.",
+              "type": "number",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string",
+              "len_min": 0,
+              "default": ""
+            }
+          },
+          {
+            "header_type": {
+              "description": "An optional string to use as part of the Authorization header. By default, a valid Authorization header looks like this: `Authorization: ldap base64(username:password)`. If `header_type` is set to \"basic\", then the Authorization header would be `Authorization: basic base64(username:password)`. Note that `header_type` can take any string, not just `'ldap'` and `'basic'`.",
+              "type": "string",
+              "default": "ldap"
+            }
+          },
+          {
+            "consumer_optional": {
+              "description": "Whether consumer mapping is optional. If `consumer_optional=true`, the plugin will not attempt to associate a consumer with the LDAP authenticated user.",
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          },
+          {
+            "consumer_by": {
+              "description": "Whether to authenticate consumers based on `username`, `custom_id`, or both.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "group_base_dn": {
+              "description": "Sets a distinguished name (DN) for the entry where LDAP searches for groups begin. This field is case-insensitive.',dc=com'.",
+              "type": "string"
+            }
+          },
+          {
+            "group_name_attribute": {
+              "description": "Sets the attribute holding the name of a group, typically called `name` (in Active Directory) or `cn` (in OpenLDAP). This field is case-insensitive.",
+              "type": "string"
+            }
+          },
+          {
+            "group_member_attribute": {
+              "description": "Sets the attribute holding the members of the LDAP group. This field is case-sensitive.",
+              "type": "string",
+              "default": "memberOf"
+            }
+          },
+          {
+            "log_search_results": {
+              "description": "Displays all the LDAP search results received from the LDAP server for debugging purposes. Not recommended to be enabled in a production environment.",
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          },
+          {
+            "groups_required": {
+              "description": "The groups required to be present in the LDAP search result for successful authorization. This config parameter works in both **AND** / **OR** cases. - When `[\"group1 group2\"]` are in the same array indices, both `group1` AND `group2` need to be present in the LDAP search result. - When `[\"group1\", \"group2\"]` are in different array indices, either `group1` OR `group2` need to be present in the LDAP search result.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/ldap-auth/3.12.json b/schemas/ldap-auth/3.12.json
new file mode 100644
index 00000000..f1c16374
--- /dev/null
+++ b/schemas/ldap-auth/3.12.json
@@ -0,0 +1,176 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "conditional": {
+              "then_field": "start_tls",
+              "then_err": "'ldaps' and 'start_tls' cannot be enabled simultaneously",
+              "then_match": {
+                "eq": false
+              },
+              "if_match": {
+                "eq": true
+              },
+              "if_field": "ldaps"
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "ldap_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "ldap_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "required": true,
+              "between": [
+                0,
+                65535
+              ],
+              "default": 389
+            }
+          },
+          {
+            "ldaps": {
+              "description": "Set to `true` to connect using the LDAPS protocol (LDAP over TLS).  When `ldaps` is configured, you must use port 636. If the `ldap` setting is enabled, ensure the `start_tls` setting is disabled.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "start_tls": {
+              "description": "Set it to `true` to issue StartTLS (Transport Layer Security) extended operation over `ldap` connection. If the `start_tls` setting is enabled, ensure the `ldaps` setting is disabled.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "verify_ldap_host": {
+              "description": "Set to `true` to authenticate LDAP server. The server certificate will be verified according to the CA certificates specified by the `lua_ssl_trusted_certificate` directive.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "base_dn": {
+              "description": "Base DN as the starting point for the search; e.g., dc=example,dc=com",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "attribute": {
+              "description": "Attribute to be used to search the user; e.g. cn",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "Cache expiry time in seconds.",
+              "type": "number",
+              "required": true,
+              "default": 60
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to hide the credential to the upstream server. It will be removed by Kong before proxying the request.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "timeout": {
+              "description": "An optional timeout in milliseconds when waiting for connection with LDAP server.",
+              "type": "number",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`.",
+              "type": "string"
+            }
+          },
+          {
+            "header_type": {
+              "description": "An optional string to use as part of the Authorization header",
+              "type": "string",
+              "default": "ldap"
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/loggly/3.12.json b/schemas/loggly/3.12.json
new file mode 100644
index 00000000..79b12486
--- /dev/null
+++ b/schemas/loggly/3.12.json
@@ -0,0 +1,171 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string",
+              "default": "logs-01.loggly.com"
+            }
+          },
+          {
+            "port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ],
+              "default": 514
+            }
+          },
+          {
+            "key": {
+              "type": "string",
+              "referenceable": true,
+              "encrypted": true,
+              "required": true
+            }
+          },
+          {
+            "tags": {
+              "type": "set",
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "kong"
+              ]
+            }
+          },
+          {
+            "log_level": {
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "default": "info"
+            }
+          },
+          {
+            "successful_severity": {
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "default": "info"
+            }
+          },
+          {
+            "client_errors_severity": {
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "default": "info"
+            }
+          },
+          {
+            "server_errors_severity": {
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "default": "info"
+            }
+          },
+          {
+            "timeout": {
+              "default": 10000,
+              "type": "number"
+            }
+          },
+          {
+            "custom_fields_by_lua": {
+              "keys": {
+                "type": "string",
+                "len_min": 1
+              },
+              "type": "map",
+              "values": {
+                "type": "string",
+                "len_min": 1
+              },
+              "description": "Lua code as a key-value map"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/mocking/3.12.json b/schemas/mocking/3.12.json
new file mode 100644
index 00000000..fec6a4fb
--- /dev/null
+++ b/schemas/mocking/3.12.json
@@ -0,0 +1,131 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.api_specification_filename",
+        "config.api_specification"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "api_specification_filename": {
+              "description": "The path and name of the specification file loaded into Kong Gateway's database. You cannot use this option for DB-less or hybrid mode.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "api_specification": {
+              "description": "The contents of the specification file. You must use this option for hybrid or DB-less mode. You can include the full specification as part of the configuration. In Kong Manager, you can copy and paste the contents of the spec directly into the `Config.Api Specification` text field.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "random_delay": {
+              "description": "Enables a random delay in the mocked response. Introduces delays to simulate real-time response times by APIs.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "max_delay_time": {
+              "description": "The maximum value in seconds of delay time. Set this value when `random_delay` is enabled and you want to adjust the default. The value must be greater than the `min_delay_time`.",
+              "type": "number",
+              "default": 1
+            }
+          },
+          {
+            "min_delay_time": {
+              "description": "The minimum value in seconds of delay time. Set this value when `random_delay` is enabled and you want to adjust the default. The value must be less than the `max_delay_time`.",
+              "type": "number",
+              "default": 0.001
+            }
+          },
+          {
+            "random_examples": {
+              "description": "Randomly selects one example and returns it. This parameter requires the spec to have multiple examples configured.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "included_status_codes": {
+              "description": "A global list of the HTTP status codes that can only be selected and returned.",
+              "type": "array",
+              "elements": {
+                "type": "integer"
+              }
+            }
+          },
+          {
+            "random_status_code": {
+              "description": "Determines whether to randomly select an HTTP status code from the responses of the corresponding API method. The default value is `false`, which means the minimum HTTP status code is always selected and returned.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "include_base_path": {
+              "description": "Indicates whether to include the base path when performing path match evaluation.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "custom_base_path": {
+              "description": "The base path to be used for path match evaluation. This value is ignored if `include_base_path` is set to `false`.",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "starts_with": "/",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/mtls-auth/3.12.json b/schemas/mtls-auth/3.12.json
new file mode 100644
index 00000000..e5f6f3f8
--- /dev/null
+++ b/schemas/mtls-auth/3.12.json
@@ -0,0 +1,208 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "mutually_required": [
+              "http_proxy_host",
+              "http_proxy_port"
+            ]
+          },
+          {
+            "mutually_required": [
+              "https_proxy_host",
+              "https_proxy_port"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string"
+            }
+          },
+          {
+            "consumer_by": {
+              "description": "Whether to match the subject name of the client-supplied certificate against consumer's `username` and/or `custom_id` attribute. If set to `[]` (the empty array), then auto-matching is disabled.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "ca_certificates": {
+              "description": "List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (`id`).",
+              "type": "array",
+              "elements": {
+                "uuid": true,
+                "type": "string"
+              },
+              "required": true
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "Cache expiry time in seconds.",
+              "type": "number",
+              "required": true,
+              "default": 60
+            }
+          },
+          {
+            "skip_consumer_lookup": {
+              "description": "Skip consumer lookup once certificate is trusted against the configured CA list.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "allow_partial_chain": {
+              "description": "Allow certificate verification with only an intermediate certificate. When this is enabled, you don't need to upload the full chain to Kong Certificates.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "authenticated_group_by": {
+              "description": "Certificate property to use as the authenticated group. Valid values are `CN` (Common Name) or `DN` (Distinguished Name). Once `skip_consumer_lookup` is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create allowed or denied groups of users.",
+              "type": "string",
+              "one_of": [
+                "CN",
+                "DN"
+              ],
+              "required": false,
+              "default": "CN"
+            }
+          },
+          {
+            "revocation_check_mode": {
+              "description": "Controls client certificate revocation check behavior. If set to `SKIP`, no revocation check is performed. If set to `IGNORE_CA_ERROR`, the plugin respects the revocation status when either OCSP or CRL URL is set, and doesn't fail on network issues. If set to `STRICT`, the plugin only treats the certificate as valid when it's able to verify the revocation status.",
+              "type": "string",
+              "one_of": [
+                "SKIP",
+                "IGNORE_CA_ERROR",
+                "STRICT"
+              ],
+              "required": false,
+              "default": "IGNORE_CA_ERROR"
+            }
+          },
+          {
+            "http_timeout": {
+              "description": "HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.",
+              "type": "number",
+              "default": 30000
+            }
+          },
+          {
+            "cert_cache_ttl": {
+              "description": "The length of time in seconds between refreshes of the revocation check status cache.",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "send_ca_dn": {
+              "description": "Sends the distinguished names (DN) of the configured CA list in the TLS handshake message.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "default_consumer": {
+              "description": "The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "http_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          },
+          {
+            "https_proxy_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string"
+            }
+          },
+          {
+            "https_proxy_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ]
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/oas-validation/3.12.json b/schemas/oas-validation/3.12.json
new file mode 100644
index 00000000..6da37b7b
--- /dev/null
+++ b/schemas/oas-validation/3.12.json
@@ -0,0 +1,168 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "api_spec": {
+              "description": "The API specification defined using either Swagger or the OpenAPI. This can be either a JSON or YAML based file. If using a YAML file, the spec needs to be URI-Encoded to preserve the YAML format.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "verbose_response": {
+              "description": "If set to true, returns a detailed error message for invalid requests & responses. This is useful while testing.",
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          },
+          {
+            "validate_request_body": {
+              "description": "If set to true, validates the request body content against the API specification.",
+              "type": "boolean",
+              "default": true,
+              "required": false
+            }
+          },
+          {
+            "notify_only_request_validation_failure": {
+              "description": "If set to true, notifications via event hooks are enabled, but request based validation failures don't affect the request flow.",
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          },
+          {
+            "validate_request_header_params": {
+              "description": "If set to true, validates HTTP header parameters against the API specification.",
+              "type": "boolean",
+              "default": true,
+              "required": false
+            }
+          },
+          {
+            "validate_request_query_params": {
+              "description": "If set to true, validates query parameters against the API specification.",
+              "type": "boolean",
+              "default": true,
+              "required": false
+            }
+          },
+          {
+            "validate_request_uri_params": {
+              "description": "If set to true, validates URI parameters in the request against the API specification.",
+              "type": "boolean",
+              "default": true,
+              "required": false
+            }
+          },
+          {
+            "validate_response_body": {
+              "description": "If set to true, validates the response from the upstream services against the API specification. If validation fails, it results in an `HTTP 406 Not Acceptable` status code.",
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          },
+          {
+            "notify_only_response_body_validation_failure": {
+              "description": "If set to true, notifications via event hooks are enabled, but response validation failures don't affect the response flow.",
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          },
+          {
+            "query_parameter_check": {
+              "description": "If set to true, checks if query parameters in the request exist in the API specification.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "header_parameter_check": {
+              "description": "If set to true, checks if HTTP header parameters in the request exist in the API specification.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "allowed_header_parameters": {
+              "description": "List of header parameters in the request that will be ignored when performing HTTP header validation. These are additional headers added to an API request beyond those defined in the API specification.  For example, you might include the HTTP header `User-Agent`, which lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.",
+              "type": "string",
+              "default": "Host,Content-Type,User-Agent,Accept,Content-Length",
+              "required": false
+            }
+          },
+          {
+            "include_base_path": {
+              "description": "Indicates whether to include the base path when performing path match evaluation.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "api_spec_encoded": {
+              "description": "Indicates whether the api_spec is URI-Encoded.",
+              "type": "boolean",
+              "default": true,
+              "required": true
+            }
+          },
+          {
+            "custom_base_path": {
+              "description": "The base path to be used for path match evaluation. This value is ignored if `include_base_path` is set to `false`.",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "starts_with": "/",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/oauth2-introspection/3.12.json b/schemas/oauth2-introspection/3.12.json
new file mode 100644
index 00000000..34081abe
--- /dev/null
+++ b/schemas/oauth2-introspection/3.12.json
@@ -0,0 +1,161 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "introspection_url": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "ttl": {
+              "description": "The TTL in seconds for the introspection response. Set to 0 to disable the expiration.",
+              "type": "number",
+              "default": 30
+            }
+          },
+          {
+            "token_type_hint": {
+              "description": "The `token_type_hint` value to associate to introspection requests.",
+              "type": "string"
+            }
+          },
+          {
+            "authorization_value": {
+              "description": "The value to set as the `Authorization` header when querying the introspection endpoint. This depends on the OAuth 2.0 server, but usually is the `client_id` and `client_secret` as a Base64-encoded Basic Auth string (`Basic MG9hNWl...`).",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "required": true
+            }
+          },
+          {
+            "timeout": {
+              "description": "An optional timeout in milliseconds when sending data to the upstream server.",
+              "type": "integer",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "An optional value in milliseconds that defines how long an idle connection lives before being closed.",
+              "type": "integer",
+              "default": 60000
+            }
+          },
+          {
+            "introspect_request": {
+              "description": "A boolean indicating whether to forward information about the current downstream request to the introspect endpoint. If true, headers `X-Request-Path` and `X-Request-Http-Method` will be inserted into the introspect request.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to hide the credential to the upstream API server. It will be removed by Kong before proxying the request.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "run_on_preflight": {
+              "description": "A boolean value that indicates whether the plugin should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests will always be allowed.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string",
+              "len_min": 0,
+              "default": ""
+            }
+          },
+          {
+            "consumer_by": {
+              "description": "A string indicating whether to associate OAuth2 `username` or `client_id` with the consumer's username. OAuth2 `username` is mapped to a consumer's `username` field, while an OAuth2 `client_id` maps to a consumer's `custom_id`.",
+              "type": "string",
+              "one_of": [
+                "username",
+                "client_id"
+              ],
+              "required": true,
+              "default": "username"
+            }
+          },
+          {
+            "custom_introspection_headers": {
+              "description": "A list of custom headers to be added in the introspection request.",
+              "type": "map",
+              "values": {
+                "type": "string"
+              },
+              "required": true,
+              "keys": {
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "custom_claims_forward": {
+              "description": "A list of custom claims to be forwarded from the introspection response to the upstream request. Claims are forwarded in headers with prefix `X-Credential-{claim-name}`.",
+              "type": "set",
+              "required": true,
+              "elements": {
+                "type": "string"
+              },
+              "default": []
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/oauth2/3.12.json b/schemas/oauth2/3.12.json
new file mode 100644
index 00000000..41e0fd0f
--- /dev/null
+++ b/schemas/oauth2/3.12.json
@@ -0,0 +1,219 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https",
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "conditional": {
+              "then_field": "scopes",
+              "if_match": {
+                "eq": true
+              },
+              "then_match": {
+                "required": true
+              },
+              "if_field": "mandatory_scope"
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "scopes": {
+              "description": "Describes an array of scope names that will be available to the end user. If `mandatory_scope` is set to `true`, then `scopes` are required.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "mandatory_scope": {
+              "description": "An optional boolean value telling the plugin to require at least one `scope` to be authorized by the end user.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "provision_key": {
+              "description": "The unique key the plugin has generated when it has been added to the Service.",
+              "type": "string",
+              "encrypted": true,
+              "unique": true,
+              "auto": true,
+              "required": true
+            }
+          },
+          {
+            "token_expiration": {
+              "description": "An optional integer value telling the plugin how many seconds a token should last, after which the client will need to refresh the token. Set to `0` to disable the expiration.",
+              "type": "number",
+              "default": 7200,
+              "required": true
+            }
+          },
+          {
+            "enable_authorization_code": {
+              "description": "An optional boolean value to enable the three-legged Authorization Code flow (RFC 6742 Section 4.1).",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "enable_implicit_grant": {
+              "description": "An optional boolean value to enable the Implicit Grant flow which allows to provision a token as a result of the authorization process (RFC 6742 Section 4.2).",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "enable_client_credentials": {
+              "description": "An optional boolean value to enable the Client Credentials Grant flow (RFC 6742 Section 4.4).",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "enable_password_grant": {
+              "description": "An optional boolean value to enable the Resource Owner Password Credentials Grant flow (RFC 6742 Section 4.3).",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to show or hide the credential from the upstream service.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "accept_http_if_already_terminated": {
+              "description": "Accepts HTTPs requests that have already been terminated by a proxy or load balancer.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails.",
+              "type": "string"
+            }
+          },
+          {
+            "global_credentials": {
+              "description": "An optional boolean value that allows using the same OAuth credentials generated by the plugin with any other service whose OAuth 2.0 plugin configuration also has `config.global_credentials=true`.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "auth_header_name": {
+              "description": "The name of the header that is supposed to carry the access token.",
+              "type": "string",
+              "default": "authorization"
+            }
+          },
+          {
+            "refresh_token_ttl": {
+              "description": "Time-to-live value for data",
+              "type": "number",
+              "default": 1209600,
+              "between": [
+                0,
+                100000000
+              ],
+              "required": true
+            }
+          },
+          {
+            "reuse_refresh_token": {
+              "description": "An optional boolean value that indicates whether an OAuth refresh token is reused when refreshing an access token.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "persistent_refresh_token": {
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "pkce": {
+              "description": "Specifies a mode of how the Proof Key for Code Exchange (PKCE) should be handled by the plugin.",
+              "type": "string",
+              "one_of": [
+                "none",
+                "lax",
+                "strict"
+              ],
+              "required": false,
+              "default": "lax"
+            }
+          },
+          {
+            "realm": {
+              "description": "When authentication fails the plugin sends `WWW-Authenticate` header with `realm` attribute value.",
+              "type": "string",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/opa/3.12.json b/schemas/opa/3.12.json
new file mode 100644
index 00000000..35c7ee2a
--- /dev/null
+++ b/schemas/opa/3.12.json
@@ -0,0 +1,145 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "opa_protocol": {
+              "description": "The protocol to use when talking to Open Policy Agent (OPA) server. Allowed protocols are `http` and `https`.",
+              "type": "string",
+              "one_of": [
+                "http",
+                "https"
+              ],
+              "default": "http"
+            }
+          },
+          {
+            "opa_host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string",
+              "default": "localhost",
+              "required": true
+            }
+          },
+          {
+            "opa_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "default": 8181,
+              "between": [
+                0,
+                65535
+              ],
+              "required": true
+            }
+          },
+          {
+            "opa_path": {
+              "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "starts_with": "/",
+              "required": true
+            }
+          },
+          {
+            "include_service_in_opa_input": {
+              "description": "If set to true, the Kong Gateway Service object in use for the current request is included as input to OPA.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "include_route_in_opa_input": {
+              "description": "If set to true, the Kong Gateway Route object in use for the current request is included as input to OPA.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "include_consumer_in_opa_input": {
+              "description": "If set to true, the Kong Gateway Consumer object in use for the current request (if any) is included as input to OPA.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "include_body_in_opa_input": {
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "include_parsed_json_body_in_opa_input": {
+              "description": "If set to true and the `Content-Type` header of the current request is `application/json`, the request body will be JSON decoded and the decoded struct is included as input to OPA.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "include_uri_captures_in_opa_input": {
+              "description": "If set to true, the regex capture groups captured on the Kong Gateway Route's path field in the current request (if any) are included as input to OPA.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "ssl_verify": {
+              "description": "If set to true, the OPA certificate will be verified according to the CA certificates specified in lua_ssl_trusted_certificate.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/openid-connect/3.12.json b/schemas/openid-connect/3.12.json
new file mode 100644
index 00000000..25ec6ea1
--- /dev/null
+++ b/schemas/openid-connect/3.12.json
@@ -0,0 +1,3561 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "required": true,
+        "type": "record",
+        "fields": [
+          {
+            "issuer": {
+              "description": "The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "using_pseudo_issuer": {
+              "description": "If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with `config.issuer`.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "discovery_headers_names": {
+              "description": "Extra header names passed to the discovery endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "discovery_headers_values": {
+              "description": "Extra header values passed to the discovery endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "extra_jwks_uris": {
+              "description": "JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).",
+              "type": "set",
+              "elements": {
+                "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "rediscovery_lifetime": {
+              "description": "Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis.",
+              "type": "number",
+              "required": false,
+              "default": 30
+            }
+          },
+          {
+            "auth_methods": {
+              "description": "Types of credentials/grants to enable.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "password",
+                  "client_credentials",
+                  "authorization_code",
+                  "bearer",
+                  "introspection",
+                  "userinfo",
+                  "kong_oauth2",
+                  "refresh_token",
+                  "session"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "password",
+                "client_credentials",
+                "authorization_code",
+                "bearer",
+                "introspection",
+                "userinfo",
+                "kong_oauth2",
+                "refresh_token",
+                "session"
+              ]
+            }
+          },
+          {
+            "client_id": {
+              "description": "The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.",
+              "type": "array",
+              "encrypted": true,
+              "elements": {
+                "type": "string",
+                "referenceable": true
+              },
+              "required": false
+            }
+          },
+          {
+            "client_secret": {
+              "description": "The client secret.",
+              "type": "array",
+              "encrypted": true,
+              "elements": {
+                "type": "string",
+                "referenceable": true
+              },
+              "required": false
+            }
+          },
+          {
+            "client_auth": {
+              "description": "The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication).",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "client_secret_basic",
+                  "client_secret_post",
+                  "client_secret_jwt",
+                  "private_key_jwt",
+                  "tls_client_auth",
+                  "self_signed_tls_client_auth",
+                  "none"
+                ],
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "client_jwk": {
+              "description": "The JWK used for the private_key_jwt authentication.",
+              "type": "array",
+              "elements": {
+                "type": "record",
+                "fields": [
+                  {
+                    "issuer": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "kty": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "use": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key_ops": {
+                      "type": "array",
+                      "elements": {
+                        "required": false,
+                        "type": "string"
+                      },
+                      "required": false
+                    }
+                  },
+                  {
+                    "alg": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "kid": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "x5u": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "x5c": {
+                      "type": "array",
+                      "elements": {
+                        "required": false,
+                        "type": "string"
+                      },
+                      "required": false
+                    }
+                  },
+                  {
+                    "x5t": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "x5t#S256": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "k": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "x": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "y": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "crv": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "n": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "e": {
+                      "required": false,
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "d": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "p": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "q": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "dp": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "dq": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "qi": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "oth": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "r": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  },
+                  {
+                    "t": {
+                      "referenceable": true,
+                      "type": "string",
+                      "encrypted": true,
+                      "required": false
+                    }
+                  }
+                ],
+                "required": false
+              },
+              "required": false
+            }
+          },
+          {
+            "client_alg": {
+              "description": "The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication.",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "HS256",
+                  "HS384",
+                  "HS512",
+                  "RS256",
+                  "RS384",
+                  "RS512",
+                  "ES256",
+                  "ES384",
+                  "ES512",
+                  "PS256",
+                  "PS384",
+                  "PS512",
+                  "EdDSA"
+                ],
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "client_arg": {
+              "description": "The client to use for this request (the selection is made with a request parameter with the same name).",
+              "type": "string",
+              "required": false,
+              "default": "client_id"
+            }
+          },
+          {
+            "redirect_uri": {
+              "description": "The redirect URI passed to the authorization and token endpoints.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "login_redirect_uri": {
+              "description": "Where to redirect the client when `login_action` is set to `redirect`.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                "referenceable": true,
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "logout_redirect_uri": {
+              "description": "Where to redirect the client after the logout.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                "referenceable": true,
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "forbidden_redirect_uri": {
+              "description": "Where to redirect the client on forbidden requests.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "forbidden_error_message": {
+              "description": "The error message for the forbidden requests (when not using the redirection).",
+              "type": "string",
+              "required": false,
+              "default": "Forbidden"
+            }
+          },
+          {
+            "forbidden_destroy_session": {
+              "description": "Destroy any active session for the forbidden requests.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "unauthorized_destroy_session": {
+              "description": "Destroy any active session for the unauthorized requests.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "unauthorized_redirect_uri": {
+              "description": "Where to redirect the client on unauthorized requests.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "unauthorized_error_message": {
+              "description": "The error message for the unauthorized requests (when not using the redirection).",
+              "type": "string",
+              "required": false,
+              "default": "Unauthorized"
+            }
+          },
+          {
+            "unexpected_redirect_uri": {
+              "description": "Where to redirect the client when unexpected errors happen with the requests.",
+              "type": "array",
+              "elements": {
+                "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "response_mode": {
+              "description": "Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.",
+              "type": "string",
+              "one_of": [
+                "query",
+                "form_post",
+                "fragment",
+                "query.jwt",
+                "form_post.jwt",
+                "fragment.jwt",
+                "jwt"
+              ],
+              "required": false,
+              "default": "query"
+            }
+          },
+          {
+            "response_type": {
+              "description": "The response type passed to the authorization endpoint.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "code"
+              ]
+            }
+          },
+          {
+            "scopes": {
+              "description": "The scopes passed to the authorization and token endpoints.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string",
+                "referenceable": true
+              },
+              "default": [
+                "openid"
+              ]
+            }
+          },
+          {
+            "audience": {
+              "description": "The audience passed to the authorization endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "issuers_allowed": {
+              "description": "The issuers allowed to be present in the tokens (`iss` claim).",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "scopes_required": {
+              "description": "The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "scopes_claim": {
+              "description": "The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "scope"
+              ]
+            }
+          },
+          {
+            "audience_required": {
+              "description": "The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "audience_claim": {
+              "description": "The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "aud"
+              ]
+            }
+          },
+          {
+            "groups_required": {
+              "description": "The groups (`groups_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "groups_claim": {
+              "description": "The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "groups"
+              ]
+            }
+          },
+          {
+            "roles_required": {
+              "description": "The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "roles_claim": {
+              "description": "The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "roles"
+              ]
+            }
+          },
+          {
+            "domains": {
+              "description": "The allowed values for the `hd` claim.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "max_age": {
+              "description": "The maximum age (in seconds) compared to the `auth_time` claim.",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "authenticated_groups_claim": {
+              "description": "The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "pushed_authorization_request_endpoint": {
+              "description": "The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "pushed_authorization_request_endpoint_auth_method": {
+              "description": "The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+              "type": "string",
+              "one_of": [
+                "client_secret_basic",
+                "client_secret_post",
+                "client_secret_jwt",
+                "private_key_jwt",
+                "tls_client_auth",
+                "self_signed_tls_client_auth",
+                "none"
+              ],
+              "required": false
+            }
+          },
+          {
+            "require_pushed_authorization_requests": {
+              "description": "Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`).",
+              "type": "boolean",
+              "required": false
+            }
+          },
+          {
+            "require_proof_key_for_code_exchange": {
+              "description": "Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled).",
+              "type": "boolean",
+              "required": false
+            }
+          },
+          {
+            "require_signed_request_object": {
+              "description": "Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled).",
+              "type": "boolean",
+              "required": false
+            }
+          },
+          {
+            "authorization_endpoint": {
+              "description": "The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "authorization_query_args_names": {
+              "description": "Extra query argument names passed to the authorization endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "authorization_query_args_values": {
+              "description": "Extra query argument values passed to the authorization endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "authorization_query_args_client": {
+              "description": "Extra query arguments passed from the client to the authorization endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "authorization_rolling_timeout": {
+              "description": "Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.",
+              "type": "number",
+              "required": false,
+              "default": 600
+            }
+          },
+          {
+            "authorization_cookie_name": {
+              "description": "The authorization cookie name.",
+              "type": "string",
+              "required": false,
+              "default": "authorization"
+            }
+          },
+          {
+            "authorization_cookie_path": {
+              "description": "The authorization cookie Path flag.",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "required": false,
+              "starts_with": "/",
+              "default": "/"
+            }
+          },
+          {
+            "authorization_cookie_domain": {
+              "description": "The authorization cookie Domain flag.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "authorization_cookie_same_site": {
+              "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.",
+              "type": "string",
+              "one_of": [
+                "Strict",
+                "Lax",
+                "None",
+                "Default"
+              ],
+              "required": false,
+              "default": "Default"
+            }
+          },
+          {
+            "authorization_cookie_http_only": {
+              "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "authorization_cookie_secure": {
+              "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.",
+              "type": "boolean",
+              "required": false
+            }
+          },
+          {
+            "preserve_query_args": {
+              "description": "With this parameter, you can preserve request query arguments even when doing authorization code flow.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "token_endpoint": {
+              "description": "The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "token_endpoint_auth_method": {
+              "description": "The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+              "type": "string",
+              "one_of": [
+                "client_secret_basic",
+                "client_secret_post",
+                "client_secret_jwt",
+                "private_key_jwt",
+                "tls_client_auth",
+                "self_signed_tls_client_auth",
+                "none"
+              ],
+              "required": false
+            }
+          },
+          {
+            "token_headers_names": {
+              "description": "Extra header names passed to the token endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_headers_values": {
+              "description": "Extra header values passed to the token endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_headers_client": {
+              "description": "Extra headers passed from the client to the token endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_headers_replay": {
+              "description": "The names of token endpoint response headers to forward to the downstream client.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_headers_prefix": {
+              "description": "Add a prefix to the token endpoint response headers before forwarding them to the downstream client.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "token_headers_grants": {
+              "description": "Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant.",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "password",
+                  "client_credentials",
+                  "authorization_code",
+                  "refresh_token"
+                ],
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_post_args_names": {
+              "description": "Extra post argument names passed to the token endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_post_args_values": {
+              "description": "Extra post argument values passed to the token endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_post_args_client": {
+              "description": "Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header  This parameter can be used with `scope` values, like this:  `config.token_post_args_client=scope`  In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "introspection_endpoint": {
+              "description": "The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "introspection_endpoint_auth_method": {
+              "description": "The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+              "type": "string",
+              "one_of": [
+                "client_secret_basic",
+                "client_secret_post",
+                "client_secret_jwt",
+                "private_key_jwt",
+                "tls_client_auth",
+                "self_signed_tls_client_auth",
+                "none"
+              ],
+              "required": false
+            }
+          },
+          {
+            "introspection_hint": {
+              "description": "Introspection hint parameter value passed to the introspection endpoint.",
+              "type": "string",
+              "required": false,
+              "default": "access_token"
+            }
+          },
+          {
+            "introspection_check_active": {
+              "description": "Check that the introspection response has an `active` claim with a value of `true`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "introspection_accept": {
+              "description": "The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).",
+              "type": "string",
+              "one_of": [
+                "application/json",
+                "application/token-introspection+jwt",
+                "application/jwt"
+              ],
+              "required": false,
+              "default": "application/json"
+            }
+          },
+          {
+            "introspection_headers_names": {
+              "description": "Extra header names passed to the introspection endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "introspection_headers_values": {
+              "description": "Extra header values passed to the introspection endpoint.",
+              "type": "array",
+              "encrypted": true,
+              "elements": {
+                "type": "string",
+                "referenceable": true
+              },
+              "required": false
+            }
+          },
+          {
+            "introspection_headers_client": {
+              "description": "Extra headers passed from the client to the introspection endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "introspection_post_args_names": {
+              "description": "Extra post argument names passed to the introspection endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "introspection_post_args_values": {
+              "description": "Extra post argument values passed to the introspection endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "introspection_post_args_client": {
+              "description": "Extra post arguments passed from the client to the introspection endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "introspection_post_args_client_headers": {
+              "description": "Extra post arguments passed from the client headers to the introspection endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "introspect_jwt_tokens": {
+              "description": "Specifies whether to introspect the JWT access tokens (can be used to check for revocations).",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "revocation_endpoint": {
+              "description": "The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "revocation_endpoint_auth_method": {
+              "description": "The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate",
+              "type": "string",
+              "one_of": [
+                "client_secret_basic",
+                "client_secret_post",
+                "client_secret_jwt",
+                "private_key_jwt",
+                "tls_client_auth",
+                "self_signed_tls_client_auth",
+                "none"
+              ],
+              "required": false
+            }
+          },
+          {
+            "end_session_endpoint": {
+              "description": "The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "userinfo_endpoint": {
+              "description": "The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "userinfo_accept": {
+              "description": "The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).",
+              "type": "string",
+              "one_of": [
+                "application/json",
+                "application/jwt"
+              ],
+              "required": false,
+              "default": "application/json"
+            }
+          },
+          {
+            "userinfo_headers_names": {
+              "description": "Extra header names passed to the user info endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "userinfo_headers_values": {
+              "description": "Extra header values passed to the user info endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "userinfo_headers_client": {
+              "description": "Extra headers passed from the client to the user info endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "userinfo_query_args_names": {
+              "description": "Extra query argument names passed to the user info endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "userinfo_query_args_values": {
+              "description": "Extra query argument values passed to the user info endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "userinfo_query_args_client": {
+              "description": "Extra query arguments passed from the client to the user info endpoint.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "token_exchange_endpoint": {
+              "description": "The token exchange endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_secret": {
+              "description": "The session secret.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "session_audience": {
+              "description": "The session audience, which is the intended target application. For example `\"my-application\"`.",
+              "type": "string",
+              "required": false,
+              "default": "default"
+            }
+          },
+          {
+            "session_cookie_name": {
+              "description": "The session cookie name.",
+              "type": "string",
+              "required": false,
+              "default": "session"
+            }
+          },
+          {
+            "session_remember": {
+              "description": "Enables or disables persistent sessions.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_remember_cookie_name": {
+              "description": "Persistent session cookie name. Use with the `remember` configuration parameter.",
+              "type": "string",
+              "required": false,
+              "default": "remember"
+            }
+          },
+          {
+            "session_remember_rolling_timeout": {
+              "description": "Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.",
+              "type": "number",
+              "required": false,
+              "default": 604800
+            }
+          },
+          {
+            "session_remember_absolute_timeout": {
+              "description": "Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.",
+              "type": "number",
+              "required": false,
+              "default": 2592000
+            }
+          },
+          {
+            "session_idling_timeout": {
+              "description": "Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.",
+              "type": "number",
+              "required": false,
+              "default": 900
+            }
+          },
+          {
+            "session_rolling_timeout": {
+              "description": "Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.",
+              "type": "number",
+              "required": false,
+              "default": 3600
+            }
+          },
+          {
+            "session_absolute_timeout": {
+              "description": "Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.",
+              "type": "number",
+              "required": false,
+              "default": 86400
+            }
+          },
+          {
+            "session_cookie_path": {
+              "description": "The session cookie Path flag.",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "required": false,
+              "starts_with": "/",
+              "default": "/"
+            }
+          },
+          {
+            "session_cookie_domain": {
+              "description": "The session cookie Domain flag.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_cookie_same_site": {
+              "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.",
+              "type": "string",
+              "one_of": [
+                "Strict",
+                "Lax",
+                "None",
+                "Default"
+              ],
+              "required": false,
+              "default": "Lax"
+            }
+          },
+          {
+            "session_cookie_http_only": {
+              "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "session_cookie_secure": {
+              "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.",
+              "type": "boolean",
+              "required": false
+            }
+          },
+          {
+            "session_request_headers": {
+              "description": "Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout request headers.",
+              "type": "set",
+              "elements": {
+                "one_of": [
+                  "id",
+                  "audience",
+                  "subject",
+                  "timeout",
+                  "idling-timeout",
+                  "rolling-timeout",
+                  "absolute-timeout"
+                ],
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "session_response_headers": {
+              "description": "Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout response headers.",
+              "type": "set",
+              "elements": {
+                "one_of": [
+                  "id",
+                  "audience",
+                  "subject",
+                  "timeout",
+                  "idling-timeout",
+                  "rolling-timeout",
+                  "absolute-timeout"
+                ],
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "session_storage": {
+              "description": "The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.",
+              "type": "string",
+              "one_of": [
+                "cookie",
+                "memcache",
+                "memcached",
+                "redis"
+              ],
+              "required": false,
+              "default": "cookie"
+            }
+          },
+          {
+            "session_store_metadata": {
+              "description": "Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_enforce_same_subject": {
+              "description": "When set to `true`, audiences are forced to share the same subject.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_hash_subject": {
+              "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_hash_storage_key": {
+              "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_memcached_prefix": {
+              "description": "The memcached session key prefix.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_memcached_socket": {
+              "description": "The memcached unix socket path.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_memcached_host": {
+              "description": "The memcached host.",
+              "type": "string",
+              "required": false,
+              "default": "127.0.0.1"
+            }
+          },
+          {
+            "session_memcached_port": {
+              "description": "The memcached port.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                0,
+                65535
+              ],
+              "default": 11211
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "default": "127.0.0.1",
+                            "required": true
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "default": "127.0.0.1",
+                            "required": true
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "required": false,
+                    "default": 5
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "prefix": {
+                    "description": "The Redis session key prefix.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "socket": {
+                    "description": "The Redis unix socket path.",
+                    "type": "string",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "reverify": {
+              "description": "Specifies whether to always verify tokens stored in the session.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "jwt_session_claim": {
+              "description": "The claim to match against the JWT session cookie.",
+              "type": "string",
+              "required": false,
+              "default": "sid"
+            }
+          },
+          {
+            "jwt_session_cookie": {
+              "description": "The name of the JWT session cookie.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "bearer_token_param_type": {
+              "description": "Where to look for the bearer token: - `header`: search the `Authorization`, `access-token`, and `x-access-token` HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "header",
+                  "cookie",
+                  "query",
+                  "body"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "header",
+                "query",
+                "body"
+              ]
+            }
+          },
+          {
+            "bearer_token_cookie_name": {
+              "description": "The name of the cookie in which the bearer token is passed.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "client_credentials_param_type": {
+              "description": "Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "header",
+                  "query",
+                  "body"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "header",
+                "query",
+                "body"
+              ]
+            }
+          },
+          {
+            "password_param_type": {
+              "description": "Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "header",
+                  "query",
+                  "body"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "header",
+                "query",
+                "body"
+              ]
+            }
+          },
+          {
+            "id_token_param_type": {
+              "description": "Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "header",
+                  "query",
+                  "body"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "header",
+                "query",
+                "body"
+              ]
+            }
+          },
+          {
+            "id_token_param_name": {
+              "description": "The name of the parameter used to pass the id token.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "refresh_token_param_type": {
+              "description": "Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "header",
+                  "query",
+                  "body"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "header",
+                "query",
+                "body"
+              ]
+            }
+          },
+          {
+            "refresh_token_param_name": {
+              "description": "The name of the parameter used to pass the refresh token.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "refresh_tokens": {
+              "description": "Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a `refresh_token` available.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "upstream_headers_claims": {
+              "description": "The upstream header claims. Only top level claims are supported.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "upstream_headers_names": {
+              "description": "The upstream header names for the claim values.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "upstream_access_token_header": {
+              "description": "The upstream access token header.",
+              "type": "string",
+              "required": false,
+              "default": "authorization:bearer"
+            }
+          },
+          {
+            "upstream_access_token_jwk_header": {
+              "description": "The upstream access token JWK header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_id_token_header": {
+              "description": "The upstream id token header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_id_token_jwk_header": {
+              "description": "The upstream id token JWK header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_refresh_token_header": {
+              "description": "The upstream refresh token header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_user_info_header": {
+              "description": "The upstream user info header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_user_info_jwt_header": {
+              "description": "The upstream user info JWT header (in case the user info returns a JWT response).",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_introspection_header": {
+              "description": "The upstream introspection header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_introspection_jwt_header": {
+              "description": "The upstream introspection JWT header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "upstream_session_id_header": {
+              "description": "The upstream session id header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_headers_claims": {
+              "description": "The downstream header claims. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "downstream_headers_names": {
+              "description": "The downstream header names for the claim values.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "downstream_access_token_header": {
+              "description": "The downstream access token header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_access_token_jwk_header": {
+              "description": "The downstream access token JWK header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_id_token_header": {
+              "description": "The downstream id token header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_id_token_jwk_header": {
+              "description": "The downstream id token JWK header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_refresh_token_header": {
+              "description": "The downstream refresh token header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_user_info_header": {
+              "description": "The downstream user info header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_user_info_jwt_header": {
+              "description": "The downstream user info JWT header (in case the user info returns a JWT response).",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_introspection_header": {
+              "description": "The downstream introspection header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_introspection_jwt_header": {
+              "description": "The downstream introspection JWT header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "downstream_session_id_header": {
+              "description": "The downstream session id header.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "login_methods": {
+              "description": "Enable login functionality with specified grants.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "password",
+                  "client_credentials",
+                  "authorization_code",
+                  "bearer",
+                  "introspection",
+                  "userinfo",
+                  "kong_oauth2",
+                  "refresh_token",
+                  "session"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "authorization_code"
+              ]
+            }
+          },
+          {
+            "login_action": {
+              "description": "What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.",
+              "type": "string",
+              "one_of": [
+                "upstream",
+                "response",
+                "redirect"
+              ],
+              "required": false,
+              "default": "upstream"
+            }
+          },
+          {
+            "login_tokens": {
+              "description": "What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "id_token",
+                  "access_token",
+                  "refresh_token",
+                  "tokens",
+                  "introspection"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "id_token"
+              ]
+            }
+          },
+          {
+            "login_redirect_mode": {
+              "description": "Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).",
+              "type": "string",
+              "one_of": [
+                "query",
+                "fragment"
+              ],
+              "required": false,
+              "default": "fragment"
+            }
+          },
+          {
+            "logout_query_arg": {
+              "description": "The request query argument that activates the logout.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "logout_post_arg": {
+              "description": "The request body argument that activates the logout.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "logout_uri_suffix": {
+              "description": "The request URI suffix that activates the logout.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "logout_methods": {
+              "description": "The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "POST",
+                  "GET",
+                  "DELETE"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "POST",
+                "DELETE"
+              ]
+            }
+          },
+          {
+            "logout_revoke": {
+              "description": "Revoke tokens as part of the logout.\n\nFor more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "logout_revoke_access_token": {
+              "description": "Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "logout_revoke_refresh_token": {
+              "description": "Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "consumer_claim": {
+              "description": "The claim used for consumer mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "consumer_by": {
+              "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "id",
+                  "username",
+                  "custom_id"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "username",
+                "custom_id"
+              ]
+            }
+          },
+          {
+            "consumer_optional": {
+              "description": "Do not terminate the request if consumer mapping fails.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "credential_claim": {
+              "description": "The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "sub"
+              ]
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "run_on_preflight": {
+              "description": "Specifies whether to run this plugin on pre-flight (`OPTIONS`) requests.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "leeway": {
+              "description": "Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims",
+              "type": "number",
+              "required": false,
+              "default": 0
+            }
+          },
+          {
+            "verify_parameters": {
+              "description": "Verify plugin configuration against discovery.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "verify_nonce": {
+              "description": "Verify nonce on authorization code flow.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_claims": {
+              "description": "Verify tokens for standard claims.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "verify_signature": {
+              "description": "Verify signature of tokens.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "ignore_signature": {
+              "description": "Skip the token signature verification on certain grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.",
+              "type": "array",
+              "required": false,
+              "elements": {
+                "one_of": [
+                  "password",
+                  "client_credentials",
+                  "authorization_code",
+                  "refresh_token",
+                  "session",
+                  "introspection",
+                  "userinfo"
+                ],
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "enable_hs_signatures": {
+              "description": "Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "disable_session": {
+              "description": "Disable issuing the session cookie with the specified grants.",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "password",
+                  "client_credentials",
+                  "authorization_code",
+                  "bearer",
+                  "introspection",
+                  "userinfo",
+                  "kong_oauth2",
+                  "refresh_token",
+                  "session"
+                ],
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "The default cache ttl in seconds that is used in case the cached object does not specify the expiry.",
+              "type": "number",
+              "required": false,
+              "default": 3600
+            }
+          },
+          {
+            "cache_ttl_max": {
+              "description": "The maximum cache ttl in seconds (enforced).",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "cache_ttl_min": {
+              "description": "The minimum cache ttl in seconds (enforced).",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "cache_ttl_neg": {
+              "description": "The negative cache ttl in seconds.",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "cache_ttl_resurrect": {
+              "description": "The resurrection ttl in seconds.",
+              "type": "number",
+              "required": false
+            }
+          },
+          {
+            "cache_tokens": {
+              "description": "Cache the token endpoint requests.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "cache_tokens_salt": {
+              "description": "Salt used for generating the cache key that is used for caching the token endpoint requests.",
+              "type": "string",
+              "auto": true,
+              "required": false
+            }
+          },
+          {
+            "cache_introspection": {
+              "description": "Cache the introspection endpoint requests.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "cache_token_exchange": {
+              "description": "Cache the token exchange endpoint requests.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "cache_user_info": {
+              "description": "Cache the user info requests.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "search_user_info": {
+              "description": "Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "http_version": {
+              "description": "The HTTP version used for the requests by this plugin: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.",
+              "type": "number",
+              "default": 1.1,
+              "required": false
+            }
+          },
+          {
+            "http_proxy": {
+              "description": "The HTTP proxy.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "http_proxy_authorization": {
+              "description": "The HTTP proxy authorization.",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "https_proxy": {
+              "description": "The HTTPS proxy.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "https_proxy_authorization": {
+              "description": "The HTTPS proxy authorization.",
+              "type": "string",
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "no_proxy": {
+              "description": "Do not use proxy with these hosts.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "keepalive": {
+              "description": "Use keepalive with the HTTP client.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "ssl_verify": {
+              "description": "Verify identity provider server certificate. If set to `true`, the plugin uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "timeout": {
+              "description": "Network IO timeout in milliseconds.",
+              "type": "number",
+              "required": false,
+              "default": 10000
+            }
+          },
+          {
+            "display_errors": {
+              "description": "Display errors on failure responses.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "by_username_ignore_case": {
+              "description": "If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "resolve_distributed_claims": {
+              "description": "Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the plugin explicitly resolves these distributed claims.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "expose_error_code": {
+              "description": "Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to `false` to disable.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "token_cache_key_include_scope": {
+              "description": "Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "introspection_token_param_name": {
+              "description": "Designate token's parameter name for introspection.",
+              "type": "string",
+              "required": false,
+              "default": "token"
+            }
+          },
+          {
+            "revocation_token_param_name": {
+              "description": "Designate token's parameter name for revocation.",
+              "type": "string",
+              "required": false,
+              "default": "token"
+            }
+          },
+          {
+            "proof_of_possession_mtls": {
+              "description": "Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.",
+              "type": "string",
+              "one_of": [
+                "off",
+                "strict",
+                "optional"
+              ],
+              "default": "off",
+              "required": false
+            }
+          },
+          {
+            "proof_of_possession_auth_methods_validation": {
+              "description": "If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "tls_client_auth_cert_id": {
+              "description": "ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.",
+              "auto": false,
+              "type": "string",
+              "uuid": true,
+              "required": false
+            }
+          },
+          {
+            "tls_client_auth_ssl_verify": {
+              "description": "Verify identity provider server certificate during mTLS client authentication.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "mtls_token_endpoint": {
+              "description": "Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "mtls_introspection_endpoint": {
+              "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "mtls_revocation_endpoint": {
+              "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "proof_of_possession_dpop": {
+              "description": "Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.",
+              "type": "string",
+              "one_of": [
+                "off",
+                "strict",
+                "optional"
+              ],
+              "default": "off",
+              "required": false
+            }
+          },
+          {
+            "dpop_use_nonce": {
+              "description": "Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "dpop_proof_lifetime": {
+              "description": "Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.",
+              "type": "number",
+              "required": false,
+              "default": 300
+            }
+          },
+          {
+            "claims_forbidden": {
+              "description": "If given, these claims are forbidden in the token payload.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              },
+              "required": false
+            }
+          },
+          {
+            "cluster_cache_strategy": {
+              "description": "The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.",
+              "type": "string",
+              "one_of": [
+                "off",
+                "redis"
+              ],
+              "default": "off",
+              "required": false
+            }
+          },
+          {
+            "cluster_cache_redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "default": 5,
+                    "required": false
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "shorthand_fields": [
+          {
+            "authorization_cookie_lifetime": {
+              "deprecation": {
+                "message": "openid-connect: config.authorization_cookie_lifetime is deprecated, please use config.authorization_rolling_timeout instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "authorization_cookie_samesite": {
+              "deprecation": {
+                "message": "openid-connect: config.authorization_cookie_samesite is deprecated, please use config.authorization_cookie_same_site instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "authorization_cookie_httponly": {
+              "deprecation": {
+                "message": "openid-connect: config.authorization_cookie_httponly is deprecated, please use config.authorization_cookie_http_only instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "session_cookie_lifetime": {
+              "deprecation": {
+                "message": "openid-connect: config.session_cookie_lifetime is deprecated, please use config.session_rolling_timeout instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "session_cookie_idletime": {
+              "deprecation": {
+                "message": "openid-connect: config.session_cookie_idletime is deprecated, please use config.session_idling_timeout instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "session_cookie_samesite": {
+              "deprecation": {
+                "message": "openid-connect: config.session_cookie_samesite is deprecated, please use config.session_cookie_same_site instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_cookie_httponly": {
+              "deprecation": {
+                "message": "openid-connect: config.session_cookie_httponly is deprecated, please use config.session_cookie_http_only instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "session_memcache_prefix": {
+              "deprecation": {
+                "message": "openid-connect: config.session_memcache_prefix is deprecated, please use config.session_memcached_prefix instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_memcache_socket": {
+              "deprecation": {
+                "message": "openid-connect: config.session_memcache_socket is deprecated, please use config.session_memcached_socket instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_memcache_host": {
+              "deprecation": {
+                "message": "openid-connect: config.session_memcache_host is deprecated, please use config.session_memcached_host instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_memcache_port": {
+              "deprecation": {
+                "message": "openid-connect: config.session_memcache_port is deprecated, please use config.session_memcached_port instead",
+                "removal_in_version": "4.0"
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_cookie_renew": {
+              "deprecation": {
+                "message": "openid-connect: config.session_cookie_renew option does not exist anymore",
+                "removal_in_version": "4.0"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "session_cookie_maxsize": {
+              "deprecation": {
+                "message": "openid-connect: config.session_cookie_maxsize option does not exist anymore",
+                "removal_in_version": "4.0"
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_strategy": {
+              "deprecation": {
+                "message": "openid-connect: config.session_strategy option does not exist anymore",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_compressor": {
+              "deprecation": {
+                "message": "openid-connect: config.session_compressor option does not exist anymore",
+                "removal_in_version": "4.0"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_prefix": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_prefix is deprecated, please use config.redis.prefix instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "prefix"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_socket": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_socket is deprecated, please use config.redis.socket instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "socket"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_host": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_host is deprecated, please use config.redis.host instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "host"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_port": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_port is deprecated, please use config.redis.port instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "port"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_username": {
+              "deprecation": {
+                "message": "openid-connect: config.redis_host is deprecated, please use config.redis.host instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "username"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_password": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_password is deprecated, please use config.redis.password instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "password"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_connect_timeout": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_connect_timeout is deprecated, please use config.redis.connect_timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "connect_timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_read_timeout": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_read_timeout is deprecated, please use config.redis.read_timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "read_timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_send_timeout": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_send_timeout is deprecated, please use config.redis.send_timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "send_timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_ssl": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_ssl is deprecated, please use config.redis.ssl instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "session_redis_ssl_verify": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_ssl_verify is deprecated, please use config.redis.ssl_verify instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl_verify"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "session_redis_server_name": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_server_name is deprecated, please use config.redis.server_name instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "server_name"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_cluster_nodes": {
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "ip": {
+                      "description": "A string representing a host name, such as example.com.",
+                      "type": "string",
+                      "required": true,
+                      "default": "127.0.0.1"
+                    }
+                  },
+                  {
+                    "port": {
+                      "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                      "type": "integer",
+                      "between": [
+                        0,
+                        65535
+                      ],
+                      "default": 6379
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_cluster_nodes is deprecated, please use config.redis.cluster_nodes instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "cluster_nodes"
+                    ]
+                  }
+                ]
+              }
+            }
+          },
+          {
+            "session_redis_cluster_max_redirections": {
+              "deprecation": {
+                "message": "openid-connect: config.session_redis_cluster_max_redirections is deprecated, please use config.redis.cluster_max_redirections instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "cluster_max_redirections"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          }
+        ]
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/opentelemetry/3.12.json b/schemas/opentelemetry/3.12.json
new file mode 100644
index 00000000..99e4e6ff
--- /dev/null
+++ b/schemas/opentelemetry/3.12.json
@@ -0,0 +1,381 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "traces_endpoint",
+              "logs_endpoint"
+            ]
+          }
+        ],
+        "type": "record",
+        "shorthand_fields": [
+          {
+            "endpoint": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "referenceable": true,
+              "type": "string",
+              "deprecation": {
+                "message": "OpenTelemetry: config.endpoint is deprecated, please use config.traces_endpoint instead",
+                "removal_in_version": "4.0"
+              }
+            }
+          }
+        ],
+        "fields": [
+          {
+            "traces_endpoint": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "referenceable": true,
+              "type": "string"
+            }
+          },
+          {
+            "logs_endpoint": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "referenceable": true,
+              "type": "string"
+            }
+          },
+          {
+            "headers": {
+              "description": "The custom headers to be added in the HTTP request sent to the OTLP server. This setting is useful for adding the authentication headers (token) for the APM backend.",
+              "type": "map",
+              "values": {
+                "referenceable": true,
+                "type": "string"
+              },
+              "keys": {
+                "description": "A string representing an HTTP header name.",
+                "type": "string"
+              }
+            }
+          },
+          {
+            "resource_attributes": {
+              "keys": {
+                "required": true,
+                "type": "string"
+              },
+              "type": "map",
+              "values": {
+                "required": true,
+                "type": "string"
+              }
+            }
+          },
+          {
+            "queue": {
+              "default": {
+                "max_batch_size": 200
+              },
+              "type": "record",
+              "fields": [
+                {
+                  "max_batch_size": {
+                    "description": "Maximum number of entries that can be processed at a time.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_coalescing_delay": {
+                    "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.",
+                    "type": "number",
+                    "between": [
+                      0,
+                      3600
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_entries": {
+                    "description": "Maximum number of entries that can be waiting on the queue.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "max_bytes": {
+                    "description": "Maximum number of bytes that can be waiting on a queue, requires string content.",
+                    "type": "integer"
+                  }
+                },
+                {
+                  "max_retry_time": {
+                    "description": "Time in seconds before the queue gives up calling a failed handler for a batch.",
+                    "type": "number",
+                    "default": 60
+                  }
+                },
+                {
+                  "initial_retry_delay": {
+                    "description": "Time in seconds before the initial retry is made for a failing batch.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 0.01
+                  }
+                },
+                {
+                  "max_retry_delay": {
+                    "description": "Maximum time in seconds between retries, caps exponential backoff.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 60
+                  }
+                },
+                {
+                  "concurrency_limit": {
+                    "description": "The number of of queue delivery timers. -1 indicates unlimited.",
+                    "type": "integer",
+                    "one_of": [
+                      -1,
+                      1
+                    ],
+                    "default": 1
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "batch_span_count": {
+              "description": "The number of spans to be sent in a single batch.",
+              "type": "integer",
+              "deprecation": {
+                "old_default": 200,
+                "removal_in_version": "4.0",
+                "message": "opentelemetry: config.batch_span_count is deprecated, please use config.queue.max_batch_size instead"
+              }
+            }
+          },
+          {
+            "batch_flush_delay": {
+              "description": "The delay, in seconds, between two consecutive batches.",
+              "type": "integer",
+              "deprecation": {
+                "old_default": 3,
+                "removal_in_version": "4.0",
+                "message": "opentelemetry: config.batch_flush_delay is deprecated, please use config.queue.max_coalescing_delay instead"
+              }
+            }
+          },
+          {
+            "connect_timeout": {
+              "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ],
+              "default": 1000
+            }
+          },
+          {
+            "send_timeout": {
+              "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ],
+              "default": 5000
+            }
+          },
+          {
+            "read_timeout": {
+              "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ],
+              "default": 5000
+            }
+          },
+          {
+            "http_response_header_for_traceid": {
+              "type": "string"
+            }
+          },
+          {
+            "header_type": {
+              "type": "string",
+              "one_of": [
+                "preserve",
+                "ignore",
+                "b3",
+                "b3-single",
+                "w3c",
+                "jaeger",
+                "ot",
+                "aws",
+                "gcp",
+                "datadog",
+                "instana"
+              ],
+              "deprecation": {
+                "old_default": "preserve",
+                "removal_in_version": "4.0",
+                "message": "opentelemetry: config.header_type is deprecated, please use config.propagation options instead"
+              },
+              "default": "preserve",
+              "required": false
+            }
+          },
+          {
+            "sampling_rate": {
+              "description": "Tracing sampling rate for configuring the probability-based sampler. When set, this value supersedes the global `tracing_sampling_rate` setting from kong.conf.",
+              "type": "number",
+              "between": [
+                0,
+                1
+              ],
+              "required": false
+            }
+          },
+          {
+            "propagation": {
+              "default": {
+                "default_format": "w3c"
+              },
+              "type": "record",
+              "fields": [
+                {
+                  "extract": {
+                    "description": "Header formats used to extract tracing context from incoming requests. If multiple values are specified, the first one found will be used for extraction. If left empty, Kong will not extract any tracing context information from incoming requests and generate a trace with no parent and a new trace ID.",
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "ot",
+                        "datadog",
+                        "aws",
+                        "gcp",
+                        "instana",
+                        "w3c",
+                        "b3",
+                        "jaeger"
+                      ],
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "clear": {
+                    "description": "Header names to clear after context extraction. This allows to extract the context from a certain header and then remove it from the request, useful when extraction and injection are performed on different header formats and the original header should not be sent to the upstream. If left empty, no headers are cleared.",
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "inject": {
+                    "description": "Header formats used to inject tracing context. The value `preserve` will use the same header format as the incoming request. If multiple values are specified, all of them will be used during injection. If left empty, Kong will not inject any tracing context information in outgoing requests.",
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "preserve",
+                        "ot",
+                        "datadog",
+                        "aws",
+                        "gcp",
+                        "instana",
+                        "w3c",
+                        "b3",
+                        "b3-single",
+                        "jaeger"
+                      ],
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "default_format": {
+                    "description": "The default header format to use when extractors did not match any format in the incoming headers and `inject` is configured with the value: `preserve`. This can happen when no tracing header was found in the request, or the incoming tracing header formats were not included in `extract`.",
+                    "type": "string",
+                    "one_of": [
+                      "ot",
+                      "datadog",
+                      "aws",
+                      "gcp",
+                      "instana",
+                      "w3c",
+                      "b3",
+                      "b3-single",
+                      "jaeger"
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "sampling_strategy": {
+              "description": "The sampling strategy to use for OTLP `traces`. Set `parent_drop_probability_fallback` if you want parent-based sampling when the parent span contains a `false` sampled flag, and fallback to probability-based sampling otherwise. Set `parent_probability_fallback` if you want parent-based sampling when the parent span contains a valid sampled flag (`true` or `false`), and fallback to probability-based sampling otherwise.",
+              "type": "string",
+              "one_of": [
+                "parent_drop_probability_fallback",
+                "parent_probability_fallback"
+              ],
+              "required": true,
+              "default": "parent_drop_probability_fallback"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/post-function/3.12.json b/schemas/post-function/3.12.json
new file mode 100644
index 00000000..91d40161
--- /dev/null
+++ b/schemas/post-function/3.12.json
@@ -0,0 +1,183 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.certificate",
+        "config.rewrite",
+        "config.access",
+        "config.header_filter",
+        "config.body_filter",
+        "config.log",
+        "config.ws_handshake",
+        "config.ws_upstream_frame",
+        "config.ws_client_frame",
+        "config.ws_close"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "certificate": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "rewrite": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "access": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "header_filter": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "body_filter": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "log": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_handshake": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_client_frame": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_upstream_frame": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_close": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/pre-function/3.12.json b/schemas/pre-function/3.12.json
new file mode 100644
index 00000000..91d40161
--- /dev/null
+++ b/schemas/pre-function/3.12.json
@@ -0,0 +1,183 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.certificate",
+        "config.rewrite",
+        "config.access",
+        "config.header_filter",
+        "config.body_filter",
+        "config.log",
+        "config.ws_handshake",
+        "config.ws_upstream_frame",
+        "config.ws_client_frame",
+        "config.ws_close"
+      ]
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "certificate": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "rewrite": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "access": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "header_filter": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "body_filter": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "log": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_handshake": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_client_frame": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_upstream_frame": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          },
+          {
+            "ws_close": {
+              "required": true,
+              "type": "array",
+              "elements": {
+                "required": false,
+                "type": "string"
+              },
+              "default": []
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/prometheus/3.12.json b/schemas/prometheus/3.12.json
new file mode 100644
index 00000000..79b478f1
--- /dev/null
+++ b/schemas/prometheus/3.12.json
@@ -0,0 +1,102 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "per_consumer": {
+              "description": "A boolean value that determines if per-consumer metrics should be collected. If enabled, the `kong_http_requests_total` and `kong_bandwidth_bytes` metrics fill in the consumer label when available.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "status_code_metrics": {
+              "description": "A boolean value that determines if status code metrics should be collected. If enabled, `http_requests_total`, `stream_sessions_total` metrics will be exported.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "ai_metrics": {
+              "description": "A boolean value that determines if ai metrics should be collected. If enabled, the `ai_llm_requests_total`, `ai_llm_cost_total` and `ai_llm_tokens_total` metrics will be exported.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "latency_metrics": {
+              "description": "A boolean value that determines if latency metrics should be collected. If enabled, `kong_latency_ms`, `upstream_latency_ms` and `request_latency_ms` metrics will be exported.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "bandwidth_metrics": {
+              "description": "A boolean value that determines if bandwidth metrics should be collected. If enabled, `bandwidth_bytes` and `stream_sessions_total` metrics will be exported.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "upstream_health_metrics": {
+              "description": "A boolean value that determines if upstream metrics should be collected. If enabled, `upstream_target_health` metric will be exported.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "wasm_metrics": {
+              "type": "boolean",
+              "deprecation": {
+                "old_default": false,
+                "removal_in_version": "4.0",
+                "message": "prometheus: config.wasm_metrics was removed and has no effect"
+              }
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/proxy-cache-advanced/3.12.json b/schemas/proxy-cache-advanced/3.12.json
new file mode 100644
index 00000000..2ef03c89
--- /dev/null
+++ b/schemas/proxy-cache-advanced/3.12.json
@@ -0,0 +1,578 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "response_code": {
+              "description": "Upstream response status code considered cacheable. The integers must be a value between 100 and 900.",
+              "type": "array",
+              "required": true,
+              "len_min": 1,
+              "elements": {
+                "between": [
+                  100,
+                  900
+                ],
+                "type": "integer"
+              },
+              "default": [
+                200,
+                301,
+                404
+              ]
+            }
+          },
+          {
+            "request_method": {
+              "description": "Downstream request methods considered cacheable. Available options: `HEAD`, `GET`, `POST`, `PATCH`, `PUT`.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "one_of": [
+                  "HEAD",
+                  "GET",
+                  "POST",
+                  "PATCH",
+                  "PUT"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "GET",
+                "HEAD"
+              ]
+            }
+          },
+          {
+            "content_type": {
+              "description": "Upstream response content types considered cacheable. The plugin performs an **exact match** against each specified value; for example, if the upstream is expected to respond with a `application/json; charset=utf-8` content-type, the plugin configuration must contain said value or a `Bypass` cache status is returned.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "text/plain",
+                "application/json"
+              ]
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "TTL in seconds of cache entities.",
+              "type": "integer",
+              "gt": 0,
+              "default": 300
+            }
+          },
+          {
+            "strategy": {
+              "description": "The backing data store in which to hold cache entities. Accepted values are: `memory` and `redis`.",
+              "type": "string",
+              "one_of": [
+                "memory",
+                "redis"
+              ],
+              "required": true
+            }
+          },
+          {
+            "cache_control": {
+              "description": "When enabled, respect the Cache-Control behaviors defined in RFC7234.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "ignore_uri_case": {
+              "description": "Determines whether to treat URIs as case sensitive. By default, case sensitivity is enabled. If set to true, requests are cached while ignoring case sensitivity in the URI.",
+              "type": "boolean",
+              "default": false,
+              "required": false
+            }
+          },
+          {
+            "storage_ttl": {
+              "description": "Number of seconds to keep resources in the storage backend. This value is independent of `cache_ttl` or resource TTLs defined by Cache-Control behaviors.",
+              "type": "integer"
+            }
+          },
+          {
+            "memory": {
+              "type": "record",
+              "fields": [
+                {
+                  "dictionary_name": {
+                    "description": "The name of the shared dictionary in which to hold cache entities when the memory strategy is selected. Note that this dictionary currently must be defined manually in the Kong Nginx template.",
+                    "type": "string",
+                    "default": "kong_db_cache",
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "vary_query_params": {
+              "description": "Relevant query parameters considered for the cache key. If undefined, all params are taken into consideration. By default, the max number of params accepted is 100. You can change this value via the `lua_max_post_args` in `kong.conf`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "vary_headers": {
+              "description": "Relevant headers considered for the cache key. If undefined, none of the headers are taken into consideration.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "response_headers": {
+              "description": "Caching related diagnostic headers that should be included in cached responses",
+              "type": "record",
+              "fields": [
+                {
+                  "age": {
+                    "default": true,
+                    "type": "boolean"
+                  }
+                },
+                {
+                  "X-Cache-Status": {
+                    "default": true,
+                    "type": "boolean"
+                  }
+                },
+                {
+                  "X-Cache-Key": {
+                    "default": true,
+                    "type": "boolean"
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "default": 5,
+                    "required": false
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "bypass_on_err": {
+              "description": "Unhandled errors while trying to retrieve a cache entry (such as redis down) are resolved with `Bypass`, with the request going upstream.",
+              "type": "boolean",
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/proxy-cache/3.12.json b/schemas/proxy-cache/3.12.json
new file mode 100644
index 00000000..0083a062
--- /dev/null
+++ b/schemas/proxy-cache/3.12.json
@@ -0,0 +1,205 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "response_code": {
+              "description": "Upstream response status code considered cacheable.",
+              "type": "array",
+              "required": true,
+              "len_min": 1,
+              "elements": {
+                "between": [
+                  100,
+                  900
+                ],
+                "type": "integer"
+              },
+              "default": [
+                200,
+                301,
+                404
+              ]
+            }
+          },
+          {
+            "request_method": {
+              "description": "Downstream request methods considered cacheable.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "one_of": [
+                  "HEAD",
+                  "GET",
+                  "POST",
+                  "PATCH",
+                  "PUT"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "GET",
+                "HEAD"
+              ]
+            }
+          },
+          {
+            "content_type": {
+              "description": "Upstream response content types considered cacheable. The plugin performs an **exact match** against each specified value.",
+              "type": "array",
+              "required": true,
+              "elements": {
+                "type": "string"
+              },
+              "default": [
+                "text/plain",
+                "application/json"
+              ]
+            }
+          },
+          {
+            "cache_ttl": {
+              "description": "TTL, in seconds, of cache entities.",
+              "type": "integer",
+              "gt": 0,
+              "default": 300
+            }
+          },
+          {
+            "strategy": {
+              "description": "The backing data store in which to hold cache entities.",
+              "type": "string",
+              "one_of": [
+                "memory"
+              ],
+              "required": true
+            }
+          },
+          {
+            "cache_control": {
+              "description": "When enabled, respect the Cache-Control behaviors defined in RFC7234.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          },
+          {
+            "ignore_uri_case": {
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "storage_ttl": {
+              "description": "Number of seconds to keep resources in the storage backend. This value is independent of `cache_ttl` or resource TTLs defined by Cache-Control behaviors.",
+              "type": "integer"
+            }
+          },
+          {
+            "memory": {
+              "type": "record",
+              "fields": [
+                {
+                  "dictionary_name": {
+                    "description": "The name of the shared dictionary in which to hold cache entities when the memory strategy is selected. Note that this dictionary currently must be defined manually in the Kong Nginx template.",
+                    "type": "string",
+                    "required": true,
+                    "default": "kong_db_cache"
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "vary_query_params": {
+              "description": "Relevant query parameters considered for the cache key. If undefined, all params are taken into consideration.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "vary_headers": {
+              "description": "Relevant headers considered for the cache key. If undefined, none of the headers are taken into consideration.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "response_headers": {
+              "description": "Caching related diagnostic headers that should be included in cached responses",
+              "type": "record",
+              "fields": [
+                {
+                  "age": {
+                    "default": true,
+                    "type": "boolean"
+                  }
+                },
+                {
+                  "X-Cache-Status": {
+                    "default": true,
+                    "type": "boolean"
+                  }
+                },
+                {
+                  "X-Cache-Key": {
+                    "default": true,
+                    "type": "boolean"
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/rate-limiting-advanced/3.12.json b/schemas/rate-limiting-advanced/3.12.json
new file mode 100644
index 00000000..2bf07b6b
--- /dev/null
+++ b/schemas/rate-limiting-advanced/3.12.json
@@ -0,0 +1,656 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "identifier": {
+              "description": "The type of identifier used to generate the rate limit key. Defines the scope used to increment the rate limiting counters. Can be `ip`, `credential`, `consumer`, `service`, `header`, `path` or `consumer-group`. Note if `identifier` is `consumer-group`, the plugin must be applied on a consumer group entity. Because a consumer may belong to multiple consumer groups, the plugin needs to know explicitly which consumer group to limit the rate.",
+              "type": "string",
+              "one_of": [
+                "ip",
+                "credential",
+                "consumer",
+                "service",
+                "header",
+                "path",
+                "consumer-group"
+              ],
+              "default": "consumer",
+              "required": true
+            }
+          },
+          {
+            "compound_identifier": {
+              "description": "Similar to `identifer`, but supports combining multiple items. The priority of `compound_identifier` is higher than `identifier`, which means if `compound_identifer` is set, it will be used, otherwise `identifier` will be used.",
+              "type": "array",
+              "elements": {
+                "one_of": [
+                  "ip",
+                  "credential",
+                  "consumer",
+                  "service",
+                  "header",
+                  "path",
+                  "consumer-group"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "window_size": {
+              "description": "One or more window sizes to apply a limit to (defined in seconds). There must be a matching number of window limits and sizes specified.",
+              "type": "array",
+              "elements": {
+                "type": "number"
+              },
+              "required": true
+            }
+          },
+          {
+            "window_type": {
+              "description": "Sets the time window type to either `sliding` (default) or `fixed`. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window's counters.",
+              "type": "string",
+              "one_of": [
+                "fixed",
+                "sliding"
+              ],
+              "default": "sliding"
+            }
+          },
+          {
+            "limit": {
+              "description": "One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified.",
+              "type": "array",
+              "elements": {
+                "type": "number"
+              },
+              "required": true
+            }
+          },
+          {
+            "sync_rate": {
+              "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms).",
+              "type": "number"
+            }
+          },
+          {
+            "namespace": {
+              "description": "The rate limiting library namespace to use for this plugin instance. Counter data and sync configuration is isolated in each namespace. NOTE: For the plugin instances sharing the same namespace, all the configurations that are required for synchronizing counters, e.g. `strategy`, `redis`, `sync_rate`, `dictionary_name`, need to be the same.",
+              "type": "string",
+              "auto": true,
+              "required": true
+            }
+          },
+          {
+            "strategy": {
+              "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local` and `cluster`.",
+              "type": "string",
+              "one_of": [
+                "cluster",
+                "redis",
+                "local"
+              ],
+              "default": "local",
+              "required": true
+            }
+          },
+          {
+            "dictionary_name": {
+              "description": "The shared dictionary where counters are stored. When the plugin is configured to synchronize counter data externally (that is `config.strategy` is `cluster` or `redis` and `config.sync_rate` isn't `-1`), this dictionary serves as a buffer to populate counters in the data store on each synchronization cycle.",
+              "type": "string",
+              "default": "kong_rate_limiting_counters",
+              "required": true
+            }
+          },
+          {
+            "lock_dictionary_name": {
+              "description": "The shared dictionary where concurrency control locks are stored. The default shared dictionary is `kong_locks`. The shared dictionary should be declare in nginx-kong.conf.",
+              "type": "string",
+              "default": "kong_locks",
+              "required": true
+            }
+          },
+          {
+            "hide_client_headers": {
+              "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "retry_after_jitter_max": {
+              "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.",
+              "type": "number",
+              "default": 0
+            }
+          },
+          {
+            "header_name": {
+              "description": "A string representing an HTTP header name.",
+              "type": "string"
+            }
+          },
+          {
+            "path": {
+              "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).",
+              "type": "string",
+              "starts_with": "/",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ]
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "default": "127.0.0.1",
+                            "required": true
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "default": "127.0.0.1",
+                            "required": true
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "required": false,
+                    "default": 5
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "redis_proxy_type": {
+                    "description": "If the `connection_is_proxied` is enabled, this field indicates the proxy type and version you are using. For example, you can enable this optioin when you want authentication between Kong and Envoy proxy.",
+                    "type": "string",
+                    "one_of": [
+                      "envoy_v1.31"
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "throttling": {
+              "type": "record",
+              "fields": [
+                {
+                  "enabled": {
+                    "description": "Determines if the throttling feature is enabled or not",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "interval": {
+                    "description": "The period between two successive retries for an individual request (in seconds)",
+                    "type": "number",
+                    "required": true,
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 5
+                  }
+                },
+                {
+                  "retry_times": {
+                    "description": "The maximum number of retries for an individual request",
+                    "type": "number",
+                    "required": true,
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 3
+                  }
+                },
+                {
+                  "queue_limit": {
+                    "description": "The maximum number of requests allowed for throttling",
+                    "type": "number",
+                    "required": true,
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 5
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "enforce_consumer_groups": {
+              "description": "Determines if consumer groups are allowed to override the rate limiting settings for the given Route or Service. Flipping `enforce_consumer_groups` from `true` to `false` disables the group override, but does not clear the list of consumer groups. You can then flip `enforce_consumer_groups` to `true` to re-enforce the groups.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "consumer_groups": {
+              "description": "List of consumer groups allowed to override the rate limiting settings for the given Route or Service. Required if `enforce_consumer_groups` is set to `true`.",
+              "type": "array",
+              "elements": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "disable_penalty": {
+              "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "error_code": {
+              "description": "Set a custom error code to return when the rate limit is exceeded.",
+              "type": "number",
+              "gt": 0,
+              "default": 429
+            }
+          },
+          {
+            "error_message": {
+              "description": "Set a custom error message to return when the rate limit is exceeded.",
+              "type": "string",
+              "default": "API rate limit exceeded"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/rate-limiting/3.12.json b/schemas/rate-limiting/3.12.json
new file mode 100644
index 00000000..3ce8365d
--- /dev/null
+++ b/schemas/rate-limiting/3.12.json
@@ -0,0 +1,479 @@
+{
+  "entity_checks": [
+    {
+      "at_least_one_of": [
+        "config.second",
+        "config.minute",
+        "config.hour",
+        "config.day",
+        "config.month",
+        "config.year"
+      ]
+    },
+    {
+      "conditional": {
+        "then_field": "config.redis.host",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.policy"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.redis.port",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.policy"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.redis.timeout",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.policy"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.header_name",
+        "if_match": {
+          "eq": "header"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.limit_by"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.path",
+        "if_match": {
+          "eq": "path"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.limit_by"
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "required": true,
+        "type": "record",
+        "fields": [
+          {
+            "second": {
+              "description": "The number of HTTP requests that can be made per second.",
+              "type": "number",
+              "gt": 0
+            }
+          },
+          {
+            "minute": {
+              "description": "The number of HTTP requests that can be made per minute.",
+              "type": "number",
+              "gt": 0
+            }
+          },
+          {
+            "hour": {
+              "description": "The number of HTTP requests that can be made per hour.",
+              "type": "number",
+              "gt": 0
+            }
+          },
+          {
+            "day": {
+              "description": "The number of HTTP requests that can be made per day.",
+              "type": "number",
+              "gt": 0
+            }
+          },
+          {
+            "month": {
+              "description": "The number of HTTP requests that can be made per month.",
+              "type": "number",
+              "gt": 0
+            }
+          },
+          {
+            "year": {
+              "description": "The number of HTTP requests that can be made per year.",
+              "type": "number",
+              "gt": 0
+            }
+          },
+          {
+            "limit_by": {
+              "description": "The entity that is used when aggregating the limits.",
+              "type": "string",
+              "one_of": [
+                "consumer",
+                "credential",
+                "ip",
+                "service",
+                "header",
+                "path",
+                "consumer-group"
+              ],
+              "default": "consumer"
+            }
+          },
+          {
+            "header_name": {
+              "description": "A string representing an HTTP header name.",
+              "type": "string"
+            }
+          },
+          {
+            "path": {
+              "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).",
+              "type": "string",
+              "starts_with": "/",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ]
+            }
+          },
+          {
+            "policy": {
+              "description": "The rate-limiting policies to use for retrieving and incrementing the limits.",
+              "type": "string",
+              "one_of": [
+                "local",
+                "cluster",
+                "redis"
+              ],
+              "len_min": 0,
+              "default": "local"
+            }
+          },
+          {
+            "fault_tolerant": {
+              "description": "A boolean value that determines if the requests should be proxied even if Kong has troubles connecting a third-party data store. If `true`, requests will be proxied anyway, effectively disabling the rate-limiting function until the data store is working again. If `false`, then the clients will see `500` errors.",
+              "type": "boolean",
+              "default": true,
+              "required": true
+            }
+          },
+          {
+            "redis": {
+              "description": "Redis configuration",
+              "type": "record",
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "len_min": 0,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "hide_client_headers": {
+              "description": "Optionally hide informative response headers.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "error_code": {
+              "description": "Set a custom error code to return when the rate limit is exceeded.",
+              "type": "number",
+              "gt": 0,
+              "default": 429
+            }
+          },
+          {
+            "error_message": {
+              "description": "Set a custom error message to return when the rate limit is exceeded.",
+              "type": "string",
+              "default": "API rate limit exceeded"
+            }
+          },
+          {
+            "sync_rate": {
+              "description": "How often to sync counter data to the central data store. A value of -1 results in synchronous behavior.",
+              "type": "number",
+              "default": -1,
+              "required": true
+            }
+          }
+        ],
+        "shorthand_fields": [
+          {
+            "redis_host": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_host is deprecated, please use config.redis.host instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "host"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "redis_port": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_port is deprecated, please use config.redis.port instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "port"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "redis_password": {
+              "len_min": 0,
+              "type": "string",
+              "deprecation": {
+                "message": "rate-limiting: config.redis_password is deprecated, please use config.redis.password instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "password"
+                    ]
+                  }
+                ]
+              }
+            }
+          },
+          {
+            "redis_username": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_username is deprecated, please use config.redis.username instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "username"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "redis_ssl": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_ssl is deprecated, please use config.redis.ssl instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "redis_ssl_verify": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_ssl_verify is deprecated, please use config.redis.ssl_verify instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl_verify"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "redis_server_name": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_server_name is deprecated, please use config.redis.server_name instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "server_name"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "redis_timeout": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_timeout is deprecated, please use config.redis.timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "redis_database": {
+              "deprecation": {
+                "message": "rate-limiting: config.redis_database is deprecated, please use config.redis.database instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "database"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          }
+        ]
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ce": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/redirect/3.12.json b/schemas/redirect/3.12.json
new file mode 100644
index 00000000..d56dc5ee
--- /dev/null
+++ b/schemas/redirect/3.12.json
@@ -0,0 +1,61 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "status_code": {
+              "description": "The response code to send. Must be an integer between 100 and 599.",
+              "type": "integer",
+              "required": true,
+              "between": [
+                100,
+                599
+              ],
+              "default": 301
+            }
+          },
+          {
+            "location": {
+              "description": "The URL to redirect to",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "keep_incoming_path": {
+              "description": "Use the incoming request's path and query string in the redirect URL",
+              "type": "boolean",
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/request-callout/3.12.json b/schemas/request-callout/3.12.json
new file mode 100644
index 00000000..af27acc2
--- /dev/null
+++ b/schemas/request-callout/3.12.json
@@ -0,0 +1,957 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "callouts": {
+              "description": "A collection of callout objects, where each object represents an HTTP request made in the context of a proxy request.",
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "name": {
+                      "description": "A string identifier for a callout. A callout object is referenceable via its name in the `kong.ctx.shared.callouts.<name>`",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "depends_on": {
+                      "description": "An array of callout names the current callout depends on. This dependency list determines the callout execution order via a topological sorting algorithm.",
+                      "type": "array",
+                      "required": true,
+                      "elements": {
+                        "type": "string",
+                        "required": true
+                      },
+                      "default": []
+                    }
+                  },
+                  {
+                    "request": {
+                      "description": "The customizations for the callout request.",
+                      "type": "record",
+                      "fields": [
+                        {
+                          "url": {
+                            "description": "The URL that will be requested. Values can contain Lua expressions in the form `$(some_lua_expression)`. The syntax is based on `request-transformer-advanced` templates.",
+                            "referenceable": true,
+                            "type": "string",
+                            "required": true
+                          }
+                        },
+                        {
+                          "method": {
+                            "description": "The HTTP method that will be requested.",
+                            "type": "string",
+                            "default": "GET",
+                            "match": "^%u+$",
+                            "required": true
+                          }
+                        },
+                        {
+                          "http_opts": {
+                            "description": "HTTP connection parameters.",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "ssl_verify": {
+                                  "description": "If set to `true`, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                                  "type": "boolean",
+                                  "default": false
+                                }
+                              },
+                              {
+                                "ssl_server_name": {
+                                  "description": "The SNI used in the callout request. Defaults to host if omitted.",
+                                  "type": "string"
+                                }
+                              },
+                              {
+                                "timeouts": {
+                                  "description": "Socket timeouts in milliseconds. All or none must be set.",
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "connect": {
+                                        "description": "The socket connect timeout.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ]
+                                      }
+                                    },
+                                    {
+                                      "write": {
+                                        "description": "The socket write timeout.",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ]
+                                      }
+                                    },
+                                    {
+                                      "read": {
+                                        "description": "The socket read timeout. ",
+                                        "type": "integer",
+                                        "between": [
+                                          0,
+                                          2147483646
+                                        ]
+                                      }
+                                    }
+                                  ],
+                                  "entity_checks": [
+                                    {
+                                      "mutually_required": [
+                                        "connect",
+                                        "write",
+                                        "read"
+                                      ]
+                                    }
+                                  ]
+                                }
+                              },
+                              {
+                                "proxy": {
+                                  "description": "Proxy settings.",
+                                  "type": "record",
+                                  "fields": [
+                                    {
+                                      "auth_username": {
+                                        "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.",
+                                        "type": "string",
+                                        "referenceable": true,
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "auth_password": {
+                                        "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.",
+                                        "referenceable": true,
+                                        "encrypted": true,
+                                        "type": "string",
+                                        "required": false
+                                      }
+                                    },
+                                    {
+                                      "https_proxy": {
+                                        "description": "The HTTPS proxy URL. This proxy server will be used for HTTPS requests.",
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "http_proxy": {
+                                        "description": "The HTTP proxy URL. This proxy server will be used for HTTP requests.",
+                                        "type": "string"
+                                      }
+                                    }
+                                  ]
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "query": {
+                            "description": "Callout request query param customizations.",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "forward": {
+                                  "description": "If `true`, forwards the incoming request's query params to the callout request. ",
+                                  "type": "boolean",
+                                  "default": false
+                                }
+                              },
+                              {
+                                "custom": {
+                                  "keys": {
+                                    "type": "string"
+                                  },
+                                  "type": "map",
+                                  "values": {
+                                    "referenceable": true,
+                                    "type": "string",
+                                    "required": false
+                                  },
+                                  "description": "The custom query params to be added in the callout HTTP request. Values can contain Lua expressions in the form `$(some_lua_expression)`. The syntax is based on `request-transformer-advanced` templates.",
+                                  "required": false
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "headers": {
+                            "description": "Callout request header customizations.",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "forward": {
+                                  "description": "If `true`, forwards the incoming request's headers to the callout request. ",
+                                  "type": "boolean",
+                                  "default": false
+                                }
+                              },
+                              {
+                                "custom": {
+                                  "keys": {
+                                    "type": "string"
+                                  },
+                                  "type": "map",
+                                  "values": {
+                                    "referenceable": true,
+                                    "type": "string",
+                                    "required": false
+                                  },
+                                  "description": "The custom headers to be added in the callout HTTP request. Values can contain Lua expressions in the form `$(some_lua_expression)`. The syntax is based on `request-transformer-advanced` templates.",
+                                  "required": false
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "body": {
+                            "description": "Callout request body customizations.",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "forward": {
+                                  "description": "If `true`, forwards the incoming request's body to the callout request.",
+                                  "type": "boolean",
+                                  "default": false
+                                }
+                              },
+                              {
+                                "decode": {
+                                  "description": "If `true`, decodes the request's body and make it available for customizations. Only JSON content type is supported.",
+                                  "type": "boolean",
+                                  "default": false
+                                }
+                              },
+                              {
+                                "custom": {
+                                  "keys": {
+                                    "type": "string"
+                                  },
+                                  "type": "map",
+                                  "values": {
+                                    "referenceable": true,
+                                    "type": "string",
+                                    "required": false
+                                  },
+                                  "description": "The custom body fields to be added to the callout HTTP request. Values can contain Lua expressions in the form $(some_lua_expression). The syntax is based on `request-transformer-advanced` templates.",
+                                  "required": false
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "error": {
+                            "description": "The error handling policy the plugin will apply to TCP and HTTP errors.",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "on_error": {
+                                  "type": "string",
+                                  "one_of": [
+                                    "retry",
+                                    "fail",
+                                    "continue"
+                                  ],
+                                  "default": "fail"
+                                }
+                              },
+                              {
+                                "retries": {
+                                  "description": "The number of retries the plugin will attempt on TCP and HTTP errors if `on_error` is set to `retry`.",
+                                  "type": "integer",
+                                  "default": 2
+                                }
+                              },
+                              {
+                                "http_statuses": {
+                                  "description": "The list of HTTP status codes considered errors under the error handling policy.",
+                                  "type": "array",
+                                  "elements": {
+                                    "between": [
+                                      100,
+                                      999
+                                    ],
+                                    "type": "integer"
+                                  }
+                                }
+                              },
+                              {
+                                "error_response_code": {
+                                  "description": "The error code to respond with if `on_error` is `fail` or if `retries` is achieved.",
+                                  "type": "integer",
+                                  "default": 400
+                                }
+                              },
+                              {
+                                "error_response_msg": {
+                                  "description": "The error mesasge to respond with if `on_error` is set to `fail` or if `retries` is achieved. Templating with Lua expressions is supported.",
+                                  "type": "string",
+                                  "default": "service callout error"
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "by_lua": {
+                            "description": "Lua code that executes before the callout request is made. **Warning** can impact system behavior. Standard Lua sandboxing restrictions apply.",
+                            "type": "string",
+                            "required": false
+                          }
+                        }
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "response": {
+                      "description": "Configurations of callout response handling.",
+                      "type": "record",
+                      "fields": [
+                        {
+                          "headers": {
+                            "description": "Callout response header customizations.",
+                            "type": "record",
+                            "fields": [
+                              {
+                                "store": {
+                                  "description": "If `false`, skips storing the callout response headers into kong.ctx.shared.callouts.<name>.response.headers.",
+                                  "type": "boolean",
+                                  "default": true
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "body": {
+                            "type": "record",
+                            "fields": [
+                              {
+                                "store": {
+                                  "description": "If `false`, skips storing the callout response body into kong.ctx.shared.callouts.<name>.response.body.",
+                                  "type": "boolean",
+                                  "default": true
+                                }
+                              },
+                              {
+                                "decode": {
+                                  "description": "If `true`, decodes the response body before storing into the context. Only JSON is supported.",
+                                  "type": "boolean",
+                                  "default": false
+                                }
+                              }
+                            ],
+                            "required": true
+                          }
+                        },
+                        {
+                          "by_lua": {
+                            "description": "Lua code that executes after the callout response is received, before caching takes place. Can produce side effects. Standard Lua sandboxing restrictions apply.",
+                            "type": "string",
+                            "required": false
+                          }
+                        }
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "cache": {
+                      "description": "Callout caching configuration.",
+                      "type": "record",
+                      "fields": [
+                        {
+                          "bypass": {
+                            "description": "If `true`, skips caching the callout response.",
+                            "type": "boolean",
+                            "default": false
+                          }
+                        }
+                      ],
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "required": true
+            }
+          },
+          {
+            "cache": {
+              "description": "Plugin global caching configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "The backing data store in which to hold cache entities. Accepted values are: `off`, `memory`, and `redis`.",
+                    "type": "string",
+                    "one_of": [
+                      "memory",
+                      "redis",
+                      "off"
+                    ],
+                    "required": true,
+                    "default": "off"
+                  }
+                },
+                {
+                  "memory": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "dictionary_name": {
+                          "description": "The name of the shared dictionary in which to hold cache entities when the memory strategy is selected. Note that this dictionary currently must be defined manually in the Kong Nginx template.",
+                          "type": "string",
+                          "required": true,
+                          "default": "kong_db_cache"
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "redis": {
+                    "entity_checks": [
+                      {
+                        "mutually_required": [
+                          "host",
+                          "port"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "sentinel_master",
+                          "sentinel_role",
+                          "sentinel_nodes"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "connect_timeout",
+                          "send_timeout",
+                          "read_timeout"
+                        ]
+                      },
+                      {
+                        "conditional": {
+                          "then_field": "host",
+                          "if_match": {
+                            "eq": true
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "connection_is_proxied"
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "database",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "cluster_nodes",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "sentinel_role",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "shorthand_fields": [
+                      {
+                        "timeout": {
+                          "deprecation": {
+                            "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "connect_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "send_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "read_timeout"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "integer"
+                        }
+                      },
+                      {
+                        "sentinel_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "sentinel_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "cluster_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "cluster_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      }
+                    ],
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ],
+                          "default": 6379
+                        }
+                      },
+                      {
+                        "connect_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "send_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "read_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_username": {
+                          "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_password": {
+                          "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "Database to use for the Redis connection when using the `redis` strategy",
+                          "type": "integer",
+                          "default": 0
+                        }
+                      },
+                      {
+                        "keepalive_pool_size": {
+                          "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                          "type": "integer",
+                          "between": [
+                            1,
+                            2147483646
+                          ],
+                          "default": 256
+                        }
+                      },
+                      {
+                        "keepalive_backlog": {
+                          "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_master": {
+                          "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "sentinel_role": {
+                          "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                          "type": "string",
+                          "one_of": [
+                            "master",
+                            "slave",
+                            "any"
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_nodes": {
+                          "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "host": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_nodes": {
+                          "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "ip": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "If set to true, uses SSL to connect to Redis.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_max_redirections": {
+                          "description": "Maximum retry attempts for redirection.",
+                          "type": "integer",
+                          "default": 5,
+                          "required": false
+                        }
+                      },
+                      {
+                        "connection_is_proxied": {
+                          "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "cache_ttl": {
+                    "description": "TTL in seconds of cache entities.",
+                    "type": "integer",
+                    "gt": 0,
+                    "default": 300
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "upstream": {
+              "description": "Customizations to the upstream request.",
+              "type": "record",
+              "fields": [
+                {
+                  "by_lua": {
+                    "description": "Lua code that executes before the upstream request is made. Can produce side effects. Standard Lua sandboxing restrictions apply.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "query": {
+                    "description": "Upstream request query param customizations.",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "forward": {
+                          "description": "If `false`, does not forward request query params to upstream request.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "custom": {
+                          "keys": {
+                            "type": "string"
+                          },
+                          "type": "map",
+                          "values": {
+                            "referenceable": true,
+                            "type": "string",
+                            "required": false
+                          },
+                          "description": "The custom query params to be added in the upstream HTTP request. Values can contain Lua expressions in the form `$(some_lua_expression)`. The syntax is based on `request-transformer-advanced` templates.",
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "headers": {
+                    "description": "Callout request header customizations.",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "forward": {
+                          "description": "If `false`, does not forward request headers to upstream request.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "custom": {
+                          "keys": {
+                            "type": "string"
+                          },
+                          "type": "map",
+                          "values": {
+                            "referenceable": true,
+                            "type": "string",
+                            "required": false
+                          },
+                          "description": "The custom headers to be added in the upstream HTTP request. Values can contain Lua expressions in the form $(some_lua_expression). The syntax is based on `request-transformer-advanced` templates.",
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "body": {
+                    "description": "Callout request body customizations.",
+                    "type": "record",
+                    "fields": [
+                      {
+                        "forward": {
+                          "description": "If `false`, skips forwarding the incoming request's body to the upstream request.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "decode": {
+                          "description": "If `true`, decodes the request's body to make it available for upstream by_lua customizations. Only JSON content type is supported.",
+                          "type": "boolean",
+                          "default": true
+                        }
+                      },
+                      {
+                        "custom": {
+                          "keys": {
+                            "type": "string"
+                          },
+                          "type": "map",
+                          "values": {
+                            "referenceable": true,
+                            "type": "string",
+                            "required": false
+                          },
+                          "description": "The custom body fields to be added in the upstream request body. Values can contain Lua expressions in the form $(some_lua_expression). The syntax is based on `request-transformer-advanced` templates.",
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/request-size-limiting/3.12.json b/schemas/request-size-limiting/3.12.json
new file mode 100644
index 00000000..9070fb51
--- /dev/null
+++ b/schemas/request-size-limiting/3.12.json
@@ -0,0 +1,71 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "allowed_payload_size": {
+              "description": "Allowed request payload size in megabytes. Default is `128` megabytes (128000000 bytes).",
+              "type": "integer",
+              "default": 128
+            }
+          },
+          {
+            "size_unit": {
+              "description": "Size unit can be set either in `bytes`, `kilobytes`, or `megabytes` (default). This configuration is not available in versions prior to Kong Gateway 1.3 and Kong Gateway (OSS) 2.0.",
+              "type": "string",
+              "one_of": [
+                "megabytes",
+                "kilobytes",
+                "bytes"
+              ],
+              "required": true,
+              "default": "megabytes"
+            }
+          },
+          {
+            "require_content_length": {
+              "description": "Set to `true` to ensure a valid `Content-Length` header exists before reading the request body.",
+              "type": "boolean",
+              "required": true,
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/request-termination/3.12.json b/schemas/request-termination/3.12.json
new file mode 100644
index 00000000..a9e22385
--- /dev/null
+++ b/schemas/request-termination/3.12.json
@@ -0,0 +1,79 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "status_code": {
+              "description": "The response code to send. Must be an integer between 100 and 599.",
+              "type": "integer",
+              "default": 503,
+              "between": [
+                100,
+                599
+              ],
+              "required": true
+            }
+          },
+          {
+            "message": {
+              "description": "The message to send, if using the default response generator.",
+              "type": "string"
+            }
+          },
+          {
+            "content_type": {
+              "description": "Content type of the raw response configured with `config.body`.",
+              "type": "string"
+            }
+          },
+          {
+            "body": {
+              "description": "The raw response body to send. This is mutually exclusive with the `config.message` field.",
+              "type": "string"
+            }
+          },
+          {
+            "echo": {
+              "description": "When set, the plugin will echo a copy of the request back to the client. The main usecase for this is debugging. It can be combined with `trigger` in order to debug requests on live systems without disturbing real traffic.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "trigger": {
+              "description": "A string representing an HTTP header name.",
+              "type": "string"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/request-transformer-advanced/3.12.json b/schemas/request-transformer-advanced/3.12.json
new file mode 100644
index 00000000..c596c224
--- /dev/null
+++ b/schemas/request-transformer-advanced/3.12.json
@@ -0,0 +1,299 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "http_method": {
+              "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters.",
+              "type": "string",
+              "match": "^%u+$"
+            }
+          },
+          {
+            "remove": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "rename": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "replace": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "uri": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "add": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "append": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "type": "array",
+                    "elements": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "allow": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "elements": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "dots_in_keys": {
+              "description": "Specify whether dots (for example, `customers.info.phone`) should be treated as part of a property name or used to descend into nested JSON objects.",
+              "type": "boolean",
+              "default": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/request-transformer/3.12.json b/schemas/request-transformer/3.12.json
new file mode 100644
index 00000000..672e0d16
--- /dev/null
+++ b/schemas/request-transformer/3.12.json
@@ -0,0 +1,248 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "http_method": {
+              "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters.",
+              "type": "string",
+              "match": "^%u+$"
+            }
+          },
+          {
+            "remove": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "rename": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "replace": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "uri": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "add": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "append": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "querystring": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/request-validator/3.12.json b/schemas/request-validator/3.12.json
new file mode 100644
index 00000000..8d1a5259
--- /dev/null
+++ b/schemas/request-validator/3.12.json
@@ -0,0 +1,193 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "body_schema",
+              "parameter_schema"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "body_schema": {
+              "description": "The request body schema specification. One of `body_schema` or `parameter_schema` must be specified.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "allowed_content_types": {
+              "description": "List of allowed content types. The value can be configured with the `charset` parameter. For example, `application/json; charset=UTF-8`.",
+              "type": "set",
+              "elements": {
+                "required": true,
+                "type": "string"
+              },
+              "default": [
+                "application/json"
+              ]
+            }
+          },
+          {
+            "version": {
+              "description": "Which validator to use. Supported values are `kong` (default) for using Kong's own schema validator, or `draft4`, `draft7`, `draft201909`, and `draft202012` for using their respective JSON Schema Draft compliant validators.",
+              "type": "string",
+              "one_of": [
+                "kong",
+                "draft4",
+                "draft6",
+                "draft7",
+                "draft201909",
+                "draft202012"
+              ],
+              "required": true,
+              "default": "kong"
+            }
+          },
+          {
+            "parameter_schema": {
+              "description": "Array of parameter validator specification. One of `body_schema` or `parameter_schema` must be specified.",
+              "type": "array",
+              "elements": {
+                "entity_checks": [
+                  {
+                    "mutually_required": [
+                      "style",
+                      "explode",
+                      "schema"
+                    ]
+                  },
+                  {
+                    "custom_entity_check": {
+                      "field_sources": [
+                        "style",
+                        "in"
+                      ]
+                    }
+                  }
+                ],
+                "type": "record",
+                "fields": [
+                  {
+                    "in": {
+                      "description": "The location of the parameter.",
+                      "type": "string",
+                      "one_of": [
+                        "query",
+                        "header",
+                        "path"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "name": {
+                      "description": "The name of the parameter. Parameter names are case-sensitive, and correspond to the parameter name used by the `in` property. If `in` is `path`, the `name` field MUST correspond to the named capture group from the configured `route`.",
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "required": {
+                      "description": "Determines whether this parameter is mandatory.",
+                      "type": "boolean",
+                      "required": true
+                    }
+                  },
+                  {
+                    "style": {
+                      "description": "Required when `schema` and `explode` are set. Describes how the parameter value will be deserialized depending on the type of the parameter value.",
+                      "type": "string",
+                      "one_of": [
+                        "label",
+                        "form",
+                        "matrix",
+                        "simple",
+                        "spaceDelimited",
+                        "pipeDelimited",
+                        "deepObject"
+                      ]
+                    }
+                  },
+                  {
+                    "explode": {
+                      "description": "Required when `schema` and `style` are set. When `explode` is `true`, parameter values of type `array` or `object` generate separate parameters for each value of the array or key-value pair of the map. For other types of parameters, this property has no effect.",
+                      "type": "boolean"
+                    }
+                  },
+                  {
+                    "schema": {
+                      "description": "Required when `style` and `explode` are set. This is the schema defining the type used for the parameter. It is validated using `draft4` for JSON Schema draft 4 compliant validator. In addition to being a valid JSON Schema, the parameter schema MUST have a top-level `type` property to enable proper deserialization before validating.",
+                      "type": "string"
+                    }
+                  }
+                ]
+              },
+              "required": false
+            }
+          },
+          {
+            "verbose_response": {
+              "description": "If enabled, the plugin returns more verbose and detailed validation errors.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "content_type_parameter_validation": {
+              "description": "Determines whether to enable parameters validation of request content-type.",
+              "type": "boolean",
+              "default": true,
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/response-ratelimiting/3.12.json b/schemas/response-ratelimiting/3.12.json
new file mode 100644
index 00000000..beb09dd8
--- /dev/null
+++ b/schemas/response-ratelimiting/3.12.json
@@ -0,0 +1,444 @@
+{
+  "entity_checks": [
+    {
+      "conditional": {
+        "then_field": "config.redis.host",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.policy"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.redis.port",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.policy"
+      }
+    },
+    {
+      "conditional": {
+        "then_field": "config.redis.timeout",
+        "if_match": {
+          "eq": "redis"
+        },
+        "then_match": {
+          "required": true
+        },
+        "if_field": "config.policy"
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "shorthand_fields": [
+          {
+            "redis_host": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_host is deprecated, please use config.redis.host instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "host"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "redis_port": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_port is deprecated, please use config.redis.port instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "port"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "redis_password": {
+              "type": "string",
+              "len_min": 0,
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_password is deprecated, please use config.redis.password instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "password"
+                    ]
+                  }
+                ]
+              }
+            }
+          },
+          {
+            "redis_username": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_username is deprecated, please use config.redis.username instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "username"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "redis_ssl": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_ssl is deprecated, please use config.redis.ssl instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "redis_ssl_verify": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_ssl_verify is deprecated, please use config.redis.ssl_verify instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl_verify"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "redis_server_name": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_server_name is deprecated, please use config.redis.server_name instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "server_name"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "redis_timeout": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_timeout is deprecated, please use config.redis.timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "redis_database": {
+              "deprecation": {
+                "message": "response-ratelimiting: config.redis_database is deprecated, please use config.redis.database instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "database"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "header_name": {
+              "description": "The name of the response header used to increment the counters.",
+              "type": "string",
+              "default": "x-kong-limit"
+            }
+          },
+          {
+            "limit_by": {
+              "description": "The entity that will be used when aggregating the limits: `consumer`, `credential`, `ip`. If the `consumer` or the `credential` cannot be determined, the system will always fallback to `ip`.",
+              "type": "string",
+              "one_of": [
+                "consumer",
+                "credential",
+                "ip"
+              ],
+              "default": "consumer"
+            }
+          },
+          {
+            "policy": {
+              "description": "The rate-limiting policies to use for retrieving and incrementing the limits.",
+              "type": "string",
+              "one_of": [
+                "local",
+                "cluster",
+                "redis"
+              ],
+              "default": "local"
+            }
+          },
+          {
+            "fault_tolerant": {
+              "description": "A boolean value that determines if the requests should be proxied even if Kong has troubles connecting a third-party datastore. If `true`, requests will be proxied anyway, effectively disabling the rate-limiting function until the datastore is working again. If `false`, then the clients will see `500` errors.",
+              "type": "boolean",
+              "default": true,
+              "required": true
+            }
+          },
+          {
+            "redis": {
+              "description": "Redis configuration",
+              "type": "record",
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "len_min": 0,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "block_on_first_violation": {
+              "description": "A boolean value that determines if the requests should be blocked as soon as one limit is being exceeded. This will block requests that are supposed to consume other limits too.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "hide_client_headers": {
+              "description": "Optionally hide informative response headers.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "limits": {
+              "description": "A map that defines rate limits for the plugin.",
+              "type": "map",
+              "values": {
+                "entity_checks": [
+                  {
+                    "at_least_one_of": [
+                      "second",
+                      "minute",
+                      "hour",
+                      "day",
+                      "month",
+                      "year"
+                    ]
+                  }
+                ],
+                "type": "record",
+                "fields": [
+                  {
+                    "second": {
+                      "gt": 0,
+                      "type": "number"
+                    }
+                  },
+                  {
+                    "minute": {
+                      "gt": 0,
+                      "type": "number"
+                    }
+                  },
+                  {
+                    "hour": {
+                      "gt": 0,
+                      "type": "number"
+                    }
+                  },
+                  {
+                    "day": {
+                      "gt": 0,
+                      "type": "number"
+                    }
+                  },
+                  {
+                    "month": {
+                      "gt": 0,
+                      "type": "number"
+                    }
+                  },
+                  {
+                    "year": {
+                      "gt": 0,
+                      "type": "number"
+                    }
+                  }
+                ],
+                "required": true
+              },
+              "len_min": 1,
+              "keys": {
+                "type": "string"
+              },
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ce": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/response-transformer-advanced/3.12.json b/schemas/response-transformer-advanced/3.12.json
new file mode 100644
index 00000000..e3136676
--- /dev/null
+++ b/schemas/response-transformer-advanced/3.12.json
@@ -0,0 +1,308 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "remove": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "if_status": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "rename": {
+              "type": "record",
+              "fields": [
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "if_status": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "replace": {
+              "type": "record",
+              "fields": [
+                {
+                  "body": {
+                    "description": "String with which to replace the entire response body.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "json": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "if_status": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "add": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "if_status": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "append": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "if_status": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "allow": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "elements": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "transform": {
+              "type": "record",
+              "fields": [
+                {
+                  "functions": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "if_status": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json": {
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "dots_in_keys": {
+              "description": "Whether dots (for example, `customers.info.phone`) should be treated as part of a property name or used to descend into nested JSON objects..",
+              "type": "boolean",
+              "default": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/response-transformer/3.12.json b/schemas/response-transformer/3.12.json
new file mode 100644
index 00000000..1df82234
--- /dev/null
+++ b/schemas/response-transformer/3.12.json
@@ -0,0 +1,231 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "remove": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "rename": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "replace": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "description": "List of JSON type names. Specify the types of the JSON values returned when appending\nJSON properties. Each string element can be one of: boolean, number, or string.",
+                    "type": "array",
+                    "required": true,
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "add": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "description": "List of JSON type names. Specify the types of the JSON values returned when appending\nJSON properties. Each string element can be one of: boolean, number, or string.",
+                    "type": "array",
+                    "required": true,
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "append": {
+              "type": "record",
+              "fields": [
+                {
+                  "json": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "json_types": {
+                    "description": "List of JSON type names. Specify the types of the JSON values returned when appending\nJSON properties. Each string element can be one of: boolean, number, or string.",
+                    "type": "array",
+                    "required": true,
+                    "elements": {
+                      "one_of": [
+                        "boolean",
+                        "number",
+                        "string"
+                      ],
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                {
+                  "headers": {
+                    "required": true,
+                    "type": "array",
+                    "elements": {
+                      "match": "^[^:]+:.*$",
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/route-by-header/3.12.json b/schemas/route-by-header/3.12.json
new file mode 100644
index 00000000..8f372c46
--- /dev/null
+++ b/schemas/route-by-header/3.12.json
@@ -0,0 +1,74 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "rules": {
+              "description": "Route by header rules.",
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "upstream_name": {
+                      "type": "string",
+                      "required": true
+                    }
+                  },
+                  {
+                    "condition": {
+                      "keys": {
+                        "type": "string"
+                      },
+                      "type": "map",
+                      "values": {
+                        "type": "string"
+                      },
+                      "len_min": 1,
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "default": []
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/route-transformer-advanced/3.12.json b/schemas/route-transformer-advanced/3.12.json
new file mode 100644
index 00000000..00617df5
--- /dev/null
+++ b/schemas/route-transformer-advanced/3.12.json
@@ -0,0 +1,73 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "path",
+              "port",
+              "host"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "path": {
+              "type": "string"
+            }
+          },
+          {
+            "port": {
+              "type": "string"
+            }
+          },
+          {
+            "host": {
+              "type": "string"
+            }
+          },
+          {
+            "escape_path": {
+              "type": "boolean",
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/saml/3.12.json b/schemas/saml/3.12.json
new file mode 100644
index 00000000..96dcb8c0
--- /dev/null
+++ b/schemas/saml/3.12.json
@@ -0,0 +1,1234 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "required": true,
+        "type": "record",
+        "fields": [
+          {
+            "assertion_consumer_path": {
+              "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "starts_with": "/",
+              "required": true
+            }
+          },
+          {
+            "idp_sso_url": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "idp_certificate": {
+              "description": "The public certificate provided by the IdP. This is used to validate responses from the IdP.  Only include the contents of the certificate. Do not include the header (`BEGIN CERTIFICATE`) and footer (`END CERTIFICATE`) lines.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "response_encryption_key": {
+              "description": "The private encryption key required to decrypt encrypted assertions.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "request_signing_key": {
+              "description": "The private key for signing requests.  If this parameter is set, requests sent to the IdP are signed.  The `request_signing_certificate` parameter must be set as well.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "request_signing_certificate": {
+              "description": "The certificate for signing requests.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "required": false
+            }
+          },
+          {
+            "request_signature_algorithm": {
+              "description": "The signature algorithm for signing Authn requests. Options available are: - `SHA256` - `SHA384` - `SHA512`",
+              "type": "string",
+              "one_of": [
+                "SHA256",
+                "SHA384",
+                "SHA512"
+              ],
+              "default": "SHA256",
+              "required": false
+            }
+          },
+          {
+            "request_digest_algorithm": {
+              "description": "The digest algorithm for Authn requests: - `SHA256` - `SHA1`",
+              "type": "string",
+              "one_of": [
+                "SHA256",
+                "SHA1"
+              ],
+              "default": "SHA256",
+              "required": false
+            }
+          },
+          {
+            "response_signature_algorithm": {
+              "description": "The algorithm for validating signatures in SAML responses. Options available are: - `SHA256` - `SHA384` - `SHA512`",
+              "type": "string",
+              "one_of": [
+                "SHA256",
+                "SHA384",
+                "SHA512"
+              ],
+              "default": "SHA256",
+              "required": false
+            }
+          },
+          {
+            "response_digest_algorithm": {
+              "description": "The algorithm for verifying digest in SAML responses: - `SHA256` - `SHA1`",
+              "type": "string",
+              "one_of": [
+                "SHA256",
+                "SHA1"
+              ],
+              "default": "SHA256",
+              "required": false
+            }
+          },
+          {
+            "issuer": {
+              "description": "The unique identifier of the IdP application. Formatted as a URL containing information about the IdP so the SP can validate that the SAML assertions it receives are issued from the correct IdP.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "nameid_format": {
+              "description": "The requested `NameId` format. Options available are: - `Unspecified` - `EmailAddress` - `Persistent` - `Transient`",
+              "type": "string",
+              "one_of": [
+                "Unspecified",
+                "EmailAddress",
+                "Persistent",
+                "Transient"
+              ],
+              "default": "EmailAddress",
+              "required": false
+            }
+          },
+          {
+            "validate_assertion_signature": {
+              "description": "Enable signature validation for SAML responses.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer. If not set, a Kong Consumer must exist for the SAML IdP user credentials, mapping the username format to the Kong Consumer username.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_secret": {
+              "description": "The session secret. This must be a random string of 32 characters from the base64 alphabet (letters, numbers, `/`, `_` and `+`). It is used as the secret key for encrypting session data as well as state information that is sent to the IdP in the authentication exchange.",
+              "type": "string",
+              "encrypted": true,
+              "referenceable": true,
+              "len_max": 32,
+              "len_min": 32,
+              "match": "^[0-9a-zA-Z/_+]+$",
+              "required": true
+            }
+          },
+          {
+            "session_audience": {
+              "description": "The session audience, for example \"my-application\"",
+              "type": "string",
+              "required": false,
+              "default": "default"
+            }
+          },
+          {
+            "session_cookie_name": {
+              "description": "The session cookie name.",
+              "type": "string",
+              "required": false,
+              "default": "session"
+            }
+          },
+          {
+            "session_remember": {
+              "description": "Enables or disables persistent sessions",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_remember_cookie_name": {
+              "description": "Persistent session cookie name",
+              "type": "string",
+              "required": false,
+              "default": "remember"
+            }
+          },
+          {
+            "session_remember_rolling_timeout": {
+              "description": "Persistent session rolling timeout in seconds.",
+              "type": "number",
+              "required": false,
+              "default": 604800
+            }
+          },
+          {
+            "session_remember_absolute_timeout": {
+              "description": "Persistent session absolute timeout in seconds.",
+              "type": "number",
+              "required": false,
+              "default": 2592000
+            }
+          },
+          {
+            "session_idling_timeout": {
+              "description": "The session cookie idle time in seconds.",
+              "type": "number",
+              "required": false,
+              "default": 900
+            }
+          },
+          {
+            "session_rolling_timeout": {
+              "description": "The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.",
+              "type": "number",
+              "required": false,
+              "default": 3600
+            }
+          },
+          {
+            "session_absolute_timeout": {
+              "description": "The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.",
+              "type": "number",
+              "required": false,
+              "default": 86400
+            }
+          },
+          {
+            "session_cookie_path": {
+              "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).",
+              "type": "string",
+              "match_none": [
+                {
+                  "pattern": "//",
+                  "err": "must not have empty segments"
+                }
+              ],
+              "required": false,
+              "starts_with": "/",
+              "default": "/"
+            }
+          },
+          {
+            "session_cookie_domain": {
+              "description": "The session cookie domain flag.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_cookie_same_site": {
+              "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.",
+              "type": "string",
+              "one_of": [
+                "Strict",
+                "Lax",
+                "None",
+                "Default"
+              ],
+              "default": "Lax",
+              "required": false
+            }
+          },
+          {
+            "session_cookie_http_only": {
+              "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.",
+              "type": "boolean",
+              "required": false,
+              "default": true
+            }
+          },
+          {
+            "session_cookie_secure": {
+              "description": "The cookie is only sent to the server when a request is made with the https:scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.",
+              "type": "boolean",
+              "required": false
+            }
+          },
+          {
+            "session_request_headers": {
+              "elements": {
+                "one_of": [
+                  "id",
+                  "audience",
+                  "subject",
+                  "timeout",
+                  "idling-timeout",
+                  "rolling-timeout",
+                  "absolute-timeout"
+                ],
+                "type": "string"
+              },
+              "type": "set"
+            }
+          },
+          {
+            "session_response_headers": {
+              "elements": {
+                "one_of": [
+                  "id",
+                  "audience",
+                  "subject",
+                  "timeout",
+                  "idling-timeout",
+                  "rolling-timeout",
+                  "absolute-timeout"
+                ],
+                "type": "string"
+              },
+              "type": "set"
+            }
+          },
+          {
+            "session_storage": {
+              "description": "The session storage for session data: - `cookie`: stores session data with the session cookie. The session cannot be invalidated or revoked without changing the session secret, but is stateless, and doesn't require a database. - `memcached`: stores session data in memcached - `redis`: stores session data in Redis",
+              "type": "string",
+              "one_of": [
+                "cookie",
+                "memcache",
+                "memcached",
+                "redis"
+              ],
+              "default": "cookie",
+              "required": false
+            }
+          },
+          {
+            "session_store_metadata": {
+              "description": "Configures whether or not session metadata should be stored. This includes information about the active sessions for the `specific_audience` belonging to a specific subject.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_enforce_same_subject": {
+              "description": "When set to `true`, audiences are forced to share the same subject.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_hash_subject": {
+              "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_hash_storage_key": {
+              "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.",
+              "type": "boolean",
+              "required": false,
+              "default": false
+            }
+          },
+          {
+            "session_memcached_prefix": {
+              "description": "The memcached session key prefix.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_memcached_socket": {
+              "description": "The memcached unix socket path.",
+              "type": "string",
+              "required": false
+            }
+          },
+          {
+            "session_memcached_host": {
+              "description": "The memcached host.",
+              "type": "string",
+              "required": false,
+              "default": "127.0.0.1"
+            }
+          },
+          {
+            "session_memcached_port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "required": false,
+              "between": [
+                0,
+                65535
+              ],
+              "default": 11211
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "default": "127.0.0.1",
+                            "required": true
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "default": "127.0.0.1",
+                            "required": true
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "required": false,
+                    "default": 5
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                },
+                {
+                  "prefix": {
+                    "description": "The Redis session key prefix.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "socket": {
+                    "description": "The Redis unix socket path.",
+                    "type": "string",
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "shorthand_fields": [
+          {
+            "session_cookie_lifetime": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_cookie_lifetime is deprecated, please use config.session_rolling_timeout instead"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "session_cookie_idletime": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_cookie_idletime is deprecated, please use config.session_idling_timeout instead"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "session_cookie_samesite": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_cookie_samesite is deprecated, please use config.session_cookie_same_site instead"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_cookie_httponly": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_cookie_httponly is deprecated, please use config.session_cookie_http_only instead"
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "session_memcache_prefix": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_memcache_prefix is deprecated, please use config.session_memcached_prefix instead"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_memcache_socket": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_memcache_socket is deprecated, please use config.session_memcached_socket instead"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_memcache_host": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_memcache_host is deprecated, please use config.session_memcached_host instead"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_memcache_port": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_memcache_port is deprecated, please use config.session_memcached_port instead"
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_cookie_renew": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_cookie_renew option does not exist anymore"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "session_cookie_maxsize": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_cookie_maxsize option does not exist anymore"
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_strategy": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_strategy option does not exist anymore"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_compressor": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_compressor option does not exist anymore"
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_auth_ttl": {
+              "deprecation": {
+                "removal_in_version": "4.0",
+                "message": "openid-connect: config.session_auth_ttl option does not exist anymore"
+              },
+              "type": "number"
+            }
+          },
+          {
+            "session_redis_prefix": {
+              "deprecation": {
+                "message": "saml: config.session_redis_prefix is deprecated, please use config.redis.prefix instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "prefix"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_socket": {
+              "deprecation": {
+                "message": "saml: config.session_redis_socket is deprecated, please use config.redis.socket instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "socket"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_host": {
+              "deprecation": {
+                "message": "saml: config.session_redis_host is deprecated, please use config.redis.host instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "host"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_port": {
+              "deprecation": {
+                "message": "saml: config.session_redis_port is deprecated, please use config.redis.port instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "port"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_username": {
+              "deprecation": {
+                "message": "saml: config.redis_host is deprecated, please use config.redis.host instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "username"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_password": {
+              "deprecation": {
+                "message": "saml: config.session_redis_password is deprecated, please use config.redis.password instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "password"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_connect_timeout": {
+              "deprecation": {
+                "message": "saml: config.session_redis_connect_timeout is deprecated, please use config.redis.connect_timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "connect_timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_read_timeout": {
+              "deprecation": {
+                "message": "saml: config.session_redis_read_timeout is deprecated, please use config.redis.read_timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "read_timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_send_timeout": {
+              "deprecation": {
+                "message": "saml: config.session_redis_send_timeout is deprecated, please use config.redis.send_timeout instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "send_timeout"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_ssl": {
+              "deprecation": {
+                "message": "saml: config.session_redis_ssl is deprecated, please use config.redis.ssl instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "session_redis_ssl_verify": {
+              "deprecation": {
+                "message": "saml: config.session_redis_ssl_verify is deprecated, please use config.redis.ssl_verify instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "ssl_verify"
+                    ]
+                  }
+                ]
+              },
+              "type": "boolean"
+            }
+          },
+          {
+            "session_redis_server_name": {
+              "deprecation": {
+                "message": "saml: config.session_redis_server_name is deprecated, please use config.redis.server_name instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "server_name"
+                    ]
+                  }
+                ]
+              },
+              "type": "string"
+            }
+          },
+          {
+            "session_redis_cluster_nodes": {
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "ip": {
+                      "description": "A string representing a host name, such as example.com.",
+                      "type": "string",
+                      "required": true,
+                      "default": "127.0.0.1"
+                    }
+                  },
+                  {
+                    "port": {
+                      "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                      "type": "integer",
+                      "between": [
+                        0,
+                        65535
+                      ],
+                      "default": 6379
+                    }
+                  }
+                ],
+                "type": "record"
+              },
+              "deprecation": {
+                "message": "saml: config.session_redis_cluster_nodes is deprecated, please use config.redis.cluster_nodes instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "cluster_nodes"
+                    ]
+                  }
+                ]
+              }
+            }
+          },
+          {
+            "session_redis_cluster_max_redirections": {
+              "deprecation": {
+                "message": "saml: config.session_redis_cluster_max_redirections is deprecated, please use config.redis.cluster_max_redirections instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "cluster_max_redirections"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          },
+          {
+            "session_redis_cluster_maxredirections": {
+              "deprecation": {
+                "message": "saml: config.session_redis_cluster_maxredirections is deprecated, please use config.redis.cluster_max_redirections instead",
+                "removal_in_version": "4.0",
+                "replaced_with": [
+                  {
+                    "path": [
+                      "redis",
+                      "cluster_max_redirections"
+                    ]
+                  }
+                ]
+              },
+              "type": "integer"
+            }
+          }
+        ]
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/service-protection/3.12.json b/schemas/service-protection/3.12.json
new file mode 100644
index 00000000..05a7acb6
--- /dev/null
+++ b/schemas/service-protection/3.12.json
@@ -0,0 +1,548 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "route": {
+        "eq": null,
+        "reference": "routes",
+        "description": "A reference to the 'routes' table with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "window_size": {
+              "description": "One or more window sizes to apply a limit to (defined in seconds). There must be a matching number of window limits and sizes specified.",
+              "type": "array",
+              "elements": {
+                "type": "number"
+              },
+              "required": true
+            }
+          },
+          {
+            "window_type": {
+              "description": "Sets the time window type to either `sliding` (default) or `fixed`. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window's counters.",
+              "type": "string",
+              "one_of": [
+                "fixed",
+                "sliding"
+              ],
+              "default": "sliding"
+            }
+          },
+          {
+            "limit": {
+              "description": "One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified.",
+              "type": "array",
+              "elements": {
+                "type": "number"
+              },
+              "required": true
+            }
+          },
+          {
+            "sync_rate": {
+              "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms).",
+              "type": "number"
+            }
+          },
+          {
+            "namespace": {
+              "description": "The rate limiting library namespace to use for this plugin instance. Counter data and sync configuration is isolated in each namespace. NOTE: For the plugin instances sharing the same namespace, all the configurations that are required for synchronizing counters, e.g. `strategy`, `redis`, `sync_rate`, `dictionary_name`, need to be the same.",
+              "auto": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "strategy": {
+              "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local` and `cluster`.",
+              "type": "string",
+              "one_of": [
+                "cluster",
+                "redis",
+                "local"
+              ],
+              "required": true,
+              "default": "local"
+            }
+          },
+          {
+            "dictionary_name": {
+              "description": "The shared dictionary where counters are stored. When the plugin is configured to synchronize counter data externally (that is `config.strategy` is `cluster` or `redis` and `config.sync_rate` isn't `-1`), this dictionary serves as a buffer to populate counters in the data store on each synchronization cycle.",
+              "type": "string",
+              "required": true,
+              "default": "kong_rate_limiting_counters"
+            }
+          },
+          {
+            "lock_dictionary_name": {
+              "description": "The shared dictionary where concurrency control locks are stored. The default shared dictionary is `kong_locks`. The shared dictionary should be declared in nginx-kong.conf.",
+              "type": "string",
+              "required": true,
+              "default": "kong_locks"
+            }
+          },
+          {
+            "hide_client_headers": {
+              "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "retry_after_jitter_max": {
+              "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.",
+              "type": "number",
+              "default": 0
+            }
+          },
+          {
+            "redis": {
+              "entity_checks": [
+                {
+                  "mutually_required": [
+                    "host",
+                    "port"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "sentinel_master",
+                    "sentinel_role",
+                    "sentinel_nodes"
+                  ]
+                },
+                {
+                  "mutually_required": [
+                    "connect_timeout",
+                    "send_timeout",
+                    "read_timeout"
+                  ]
+                },
+                {
+                  "conditional": {
+                    "then_field": "host",
+                    "if_match": {
+                      "eq": true
+                    },
+                    "then_match": {
+                      "required": true
+                    },
+                    "if_field": "connection_is_proxied"
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "database",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "cluster_nodes",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                },
+                {
+                  "custom_entity_check": {
+                    "field_sources": [
+                      "sentinel_role",
+                      "connection_is_proxied"
+                    ],
+                    "run_with_missing_fields": true
+                  }
+                }
+              ],
+              "type": "record",
+              "shorthand_fields": [
+                {
+                  "timeout": {
+                    "deprecation": {
+                      "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "connect_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "send_timeout"
+                          ]
+                        },
+                        {
+                          "path": [
+                            "read_timeout"
+                          ]
+                        }
+                      ]
+                    },
+                    "type": "integer"
+                  }
+                },
+                {
+                  "sentinel_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "sentinel_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "cluster_addresses": {
+                    "len_min": 1,
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "deprecation": {
+                      "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                      "removal_in_version": "4.0",
+                      "replaced_with": [
+                        {
+                          "path": [
+                            "cluster_nodes"
+                          ]
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "fields": [
+                {
+                  "host": {
+                    "description": "A string representing a host name, such as example.com.",
+                    "type": "string",
+                    "default": "127.0.0.1"
+                  }
+                },
+                {
+                  "port": {
+                    "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      65535
+                    ],
+                    "default": 6379
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "send_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "read_timeout": {
+                    "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "username": {
+                    "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "password": {
+                    "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_username": {
+                    "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                    "type": "string",
+                    "referenceable": true
+                  }
+                },
+                {
+                  "sentinel_password": {
+                    "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                    "type": "string",
+                    "encrypted": true,
+                    "referenceable": true
+                  }
+                },
+                {
+                  "database": {
+                    "description": "Database to use for the Redis connection when using the `redis` strategy",
+                    "type": "integer",
+                    "default": 0
+                  }
+                },
+                {
+                  "keepalive_pool_size": {
+                    "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      2147483646
+                    ],
+                    "default": 256
+                  }
+                },
+                {
+                  "keepalive_backlog": {
+                    "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                    "type": "integer",
+                    "between": [
+                      0,
+                      2147483646
+                    ]
+                  }
+                },
+                {
+                  "sentinel_master": {
+                    "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                    "type": "string"
+                  }
+                },
+                {
+                  "sentinel_role": {
+                    "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                    "type": "string",
+                    "one_of": [
+                      "master",
+                      "slave",
+                      "any"
+                    ]
+                  }
+                },
+                {
+                  "sentinel_nodes": {
+                    "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "host": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_nodes": {
+                    "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "ip": {
+                            "description": "A string representing a host name, such as example.com.",
+                            "type": "string",
+                            "required": true,
+                            "default": "127.0.0.1"
+                          }
+                        },
+                        {
+                          "port": {
+                            "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                            "type": "integer",
+                            "between": [
+                              0,
+                              65535
+                            ],
+                            "default": 6379
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": false
+                  }
+                },
+                {
+                  "ssl": {
+                    "description": "If set to true, uses SSL to connect to Redis.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                },
+                {
+                  "server_name": {
+                    "description": "A string representing an SNI (server name indication) value for TLS.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "cluster_max_redirections": {
+                    "description": "Maximum retry attempts for redirection.",
+                    "type": "integer",
+                    "default": 5,
+                    "required": false
+                  }
+                },
+                {
+                  "connection_is_proxied": {
+                    "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                    "type": "boolean",
+                    "required": false,
+                    "default": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "disable_penalty": {
+              "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "error_code": {
+              "description": "Set a custom error code to return when the rate limit is exceeded.",
+              "type": "number",
+              "gt": 0,
+              "default": 429
+            }
+          },
+          {
+            "error_message": {
+              "description": "Set a custom error message to return when the rate limit is exceeded.",
+              "type": "string",
+              "default": "API rate limit exceeded"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/session/3.12.json b/schemas/session/3.12.json
new file mode 100644
index 00000000..ed9e984c
--- /dev/null
+++ b/schemas/session/3.12.json
@@ -0,0 +1,314 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "shorthand_fields": [
+          {
+            "cookie_lifetime": {
+              "type": "number"
+            }
+          },
+          {
+            "cookie_idletime": {
+              "type": "number"
+            }
+          },
+          {
+            "cookie_renew": {
+              "type": "number"
+            }
+          },
+          {
+            "cookie_discard": {
+              "type": "number"
+            }
+          },
+          {
+            "cookie_samesite": {
+              "type": "string"
+            }
+          },
+          {
+            "cookie_httponly": {
+              "type": "boolean"
+            }
+          },
+          {
+            "cookie_persistent": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "secret": {
+              "description": "The secret that is used in keyed HMAC generation.",
+              "referenceable": true,
+              "encrypted": true,
+              "required": false,
+              "type": "string",
+              "default": "OHD3DR0DIXyHajNcGLzHZ4pXURqJk8EgPHGvhAarIuUv"
+            }
+          },
+          {
+            "storage": {
+              "description": "Determines where the session data is stored. `kong`: Stores encrypted session data into Kong's current database strategy; the cookie will not contain any session data. `cookie`: Stores encrypted session data within the cookie itself.",
+              "type": "string",
+              "one_of": [
+                "cookie",
+                "kong"
+              ],
+              "default": "cookie"
+            }
+          },
+          {
+            "audience": {
+              "description": "The session audience, which is the intended target application. For example `\"my-application\"`.",
+              "type": "string",
+              "default": "default"
+            }
+          },
+          {
+            "idling_timeout": {
+              "description": "The session cookie idle time, in seconds.",
+              "type": "number",
+              "default": 900
+            }
+          },
+          {
+            "rolling_timeout": {
+              "description": "The session cookie rolling timeout, in seconds. Specifies how long the session can be used until it needs to be renewed.",
+              "type": "number",
+              "default": 3600
+            }
+          },
+          {
+            "absolute_timeout": {
+              "description": "The session cookie absolute timeout, in seconds. Specifies how long the session can be used until it is no longer valid.",
+              "type": "number",
+              "default": 86400
+            }
+          },
+          {
+            "stale_ttl": {
+              "description": "The duration, in seconds, after which an old cookie is discarded, starting from the moment when the session becomes outdated and is replaced by a new one.",
+              "type": "number",
+              "default": 10
+            }
+          },
+          {
+            "cookie_name": {
+              "description": "The name of the cookie.",
+              "type": "string",
+              "default": "session"
+            }
+          },
+          {
+            "cookie_path": {
+              "description": "The resource in the host where the cookie is available.",
+              "type": "string",
+              "default": "/"
+            }
+          },
+          {
+            "cookie_domain": {
+              "description": "The domain with which the cookie is intended to be exchanged.",
+              "type": "string"
+            }
+          },
+          {
+            "cookie_same_site": {
+              "description": "Determines whether and how a cookie may be sent with cross-site requests.",
+              "type": "string",
+              "one_of": [
+                "Strict",
+                "Lax",
+                "None",
+                "Default"
+              ],
+              "default": "Strict"
+            }
+          },
+          {
+            "cookie_http_only": {
+              "description": "Applies the `HttpOnly` tag so that the cookie is sent only to a server.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "cookie_secure": {
+              "description": "Applies the Secure directive so that the cookie may be sent to the server only with an encrypted request over the HTTPS protocol.",
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "remember": {
+              "description": "Enables or disables persistent sessions.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "remember_cookie_name": {
+              "description": "Persistent session cookie name. Use with the `remember` configuration parameter.",
+              "type": "string",
+              "default": "remember"
+            }
+          },
+          {
+            "remember_rolling_timeout": {
+              "description": "The persistent session rolling timeout window, in seconds.",
+              "type": "number",
+              "default": 604800
+            }
+          },
+          {
+            "remember_absolute_timeout": {
+              "description": "The persistent session absolute timeout limit, in seconds.",
+              "type": "number",
+              "default": 2592000
+            }
+          },
+          {
+            "response_headers": {
+              "description": "List of information to include, as headers, in the response to the downstream.",
+              "type": "set",
+              "elements": {
+                "one_of": [
+                  "id",
+                  "audience",
+                  "subject",
+                  "timeout",
+                  "idling-timeout",
+                  "rolling-timeout",
+                  "absolute-timeout"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "request_headers": {
+              "description": "List of information to include, as headers, in the response to the downstream.",
+              "type": "set",
+              "elements": {
+                "one_of": [
+                  "id",
+                  "audience",
+                  "subject",
+                  "timeout",
+                  "idling-timeout",
+                  "rolling-timeout",
+                  "absolute-timeout"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "read_body_for_logout": {
+              "default": false,
+              "type": "boolean"
+            }
+          },
+          {
+            "logout_methods": {
+              "description": "A set of HTTP methods that the plugin will respond to.",
+              "type": "set",
+              "elements": {
+                "one_of": [
+                  "GET",
+                  "POST",
+                  "DELETE"
+                ],
+                "type": "string"
+              },
+              "default": [
+                "POST",
+                "DELETE"
+              ]
+            }
+          },
+          {
+            "logout_query_arg": {
+              "description": "The query argument passed to logout requests.",
+              "type": "string",
+              "default": "session_logout"
+            }
+          },
+          {
+            "logout_post_arg": {
+              "description": "The POST argument passed to logout requests. Do not change this property.",
+              "type": "string",
+              "default": "session_logout"
+            }
+          },
+          {
+            "hash_subject": {
+              "description": "Whether to hash or not the subject when store_metadata is enabled.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "store_metadata": {
+              "description": "Whether to also store metadata of sessions, such as collecting data of sessions for a specific audience belonging to a specific subject.",
+              "type": "boolean",
+              "default": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/solace-upstream/3.12.json b/schemas/solace-upstream/3.12.json
new file mode 100644
index 00000000..b9075f15
--- /dev/null
+++ b/schemas/solace-upstream/3.12.json
@@ -0,0 +1,406 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "session": {
+              "description": "Session related configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "host": {
+                    "description": "The IPv4 or IPv6 address or host name to connect to (see: https://docs.solace.com/API-Developer-Online-Ref-Documentation/c/index.html#host-entry).",
+                    "referenceable": true,
+                    "type": "string",
+                    "required": true
+                  }
+                },
+                {
+                  "vpn_name": {
+                    "description": "The name of the Message VPN to attempt to join when connecting to an event broker.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "authentication": {
+                    "description": "Session authentication related configuration.",
+                    "type": "record",
+                    "entity_checks": [
+                      {
+                        "conditional": {
+                          "then_field": "username",
+                          "if_match": {
+                            "eq": "BASIC"
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "scheme"
+                        }
+                      },
+                      {
+                        "conditional": {
+                          "then_field": "password",
+                          "if_match": {
+                            "eq": "BASIC"
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "scheme"
+                        }
+                      },
+                      {
+                        "conditional_at_least_one_of": {
+                          "then_at_least_one_of": [
+                            "access_token",
+                            "access_token_header",
+                            "id_token",
+                            "id_token_header"
+                          ],
+                          "if_match": {
+                            "eq": "OAUTH2"
+                          },
+                          "then_err": "must set one of %s when 'scheme' is 'OAUTH2'",
+                          "if_field": "scheme"
+                        }
+                      }
+                    ],
+                    "fields": [
+                      {
+                        "scheme": {
+                          "description": "The client authentication scheme used when connection to an event broker.",
+                          "type": "string",
+                          "one_of": [
+                            "NONE",
+                            "BASIC",
+                            "OAUTH2"
+                          ],
+                          "default": "BASIC",
+                          "required": true
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "The username used with `BASIC` authentication scheme when connecting to an event broker.",
+                          "type": "string",
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "The password used with `BASIC` authentication scheme when connecting to an event broker.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "access_token": {
+                          "description": "The OAuth2 access token used with `OAUTH2` authentication scheme when connecting to an event broker.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "access_token_header": {
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "id_token": {
+                          "description": "The OpenID Connect ID token used with `OAUTH2` authentication scheme when connecting to an event broker.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true,
+                          "required": false
+                        }
+                      },
+                      {
+                        "id_token_header": {
+                          "type": "string",
+                          "required": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "connect_timeout": {
+                    "description": "The timeout period (in milliseconds) for a connect operation to a given host (per host).",
+                    "type": "integer",
+                    "default": 3000,
+                    "between": [
+                      100,
+                      100000
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "ssl_validate_certificate": {
+                    "description": "Indicates whether the API should validate server certificates with the trusted certificates.",
+                    "type": "boolean",
+                    "required": true,
+                    "default": false
+                  }
+                },
+                {
+                  "properties": {
+                    "description": "Additional Solace session properties (each setting needs to have `SESSION_` prefix).",
+                    "type": "map",
+                    "values": {
+                      "referenceable": true,
+                      "type": "string",
+                      "required": true
+                    },
+                    "keys": {
+                      "required": true,
+                      "type": "string",
+                      "match": "^SESSION_",
+                      "not_one_of": [
+                        "SESSION_AUTHENTICATION_SCHEME",
+                        "SESSION_USERNAME",
+                        "SESSION_PASSWORD",
+                        "SESSION_OAUTH2_ACCESS_TOKEN",
+                        "SESSION_OIDC_ID_TOKEN",
+                        "SESSION_HOST",
+                        "SESSION_VPN_NAME",
+                        "SESSION_ACK_EVENT_MODE",
+                        "SESSION_SSL_VALIDATE_CERTIFICATE",
+                        "SESSION_CONNECT_BLOCKING",
+                        "SESSION_CONNECT_TIMEOUT_MS",
+                        "SESSION_SEND_BLOCKING",
+                        "SESSION_SUBSCRIBE_BLOCKING",
+                        "SESSION_BLOCK_WHILE_CONNECTING",
+                        "SESSION_GUARANTEED_WITH_WEB_TRANSPORT"
+                      ]
+                    },
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "message": {
+              "description": "The message related configuration.",
+              "type": "record",
+              "fields": [
+                {
+                  "destinations": {
+                    "description": "The message destinations.",
+                    "type": "array",
+                    "len_min": 1,
+                    "elements": {
+                      "fields": [
+                        {
+                          "name": {
+                            "description": "The name of the destination. You can use `$(uri_captures['topic_name']` in this field.",
+                            "type": "string",
+                            "required": true
+                          }
+                        },
+                        {
+                          "type": {
+                            "description": "The type of the destination.",
+                            "type": "string",
+                            "one_of": [
+                              "QUEUE",
+                              "TOPIC"
+                            ],
+                            "required": true,
+                            "default": "QUEUE"
+                          }
+                        }
+                      ],
+                      "type": "record"
+                    },
+                    "required": true
+                  }
+                },
+                {
+                  "delivery_mode": {
+                    "description": "Sets the message delivery mode.",
+                    "type": "string",
+                    "one_of": [
+                      "DIRECT",
+                      "PERSISTENT"
+                    ],
+                    "required": true,
+                    "default": "DIRECT"
+                  }
+                },
+                {
+                  "sender_id": {
+                    "description": "Allows the application to set the content of the sender identifier.",
+                    "type": "string",
+                    "default": "kong",
+                    "required": false
+                  }
+                },
+                {
+                  "priority": {
+                    "description": "Sets the message priority.",
+                    "type": "integer",
+                    "required": true,
+                    "between": [
+                      0,
+                      255
+                    ],
+                    "default": 4
+                  }
+                },
+                {
+                  "dmq_eligible": {
+                    "description": "Sets the dead message queue (DMQ) eligible property on the message.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "ttl": {
+                    "description": "Sets the time to live (TTL) in milliseconds for the message. Setting the time to live to zero disables the TTL for the message.",
+                    "type": "integer",
+                    "gt": -1,
+                    "required": true,
+                    "default": 0
+                  }
+                },
+                {
+                  "ack_timeout": {
+                    "description": "When using a non-DIRECT guaranteed delivery mode, this property sets the message acknowledgement timeout in milliseconds (waiting time).",
+                    "type": "integer",
+                    "required": true,
+                    "between": [
+                      1,
+                      100000
+                    ],
+                    "default": 2000
+                  }
+                },
+                {
+                  "tracing": {
+                    "description": "Enable or disable the tracing. This is primarily used for distributed tracing and message correlation, especially in debugging or tracking message flows across multiple systems.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "tracing_sampled": {
+                    "description": "Indicates whether the message should be included in distributed tracing (i.e., if it should be \"sampled\" for the tracing)",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "forward_method": {
+                    "description": "Include the request method in the message.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "forward_uri": {
+                    "description": "Include the request URI and the URI arguments (as in, query arguments) in the message.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "forward_headers": {
+                    "description": "Include the request headers in the message.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "forward_body": {
+                    "description": "Include the request body and the body arguments in the message.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": true
+                  }
+                },
+                {
+                  "default_content": {
+                    "description": "When not using `forward_method`, `forward_uri`, `forward_headers` or `forward_body`, this sets the message content.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "functions": {
+                    "description": "The Lua functions that manipulates (or generates) the message being sent to Solace. The `message` variable can be used to access the current message content, and the function can return a new content.",
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    },
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/standard-webhooks/3.12.json b/schemas/standard-webhooks/3.12.json
new file mode 100644
index 00000000..2b884cd1
--- /dev/null
+++ b/schemas/standard-webhooks/3.12.json
@@ -0,0 +1,61 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "secret_v1": {
+              "description": "Webhook secret",
+              "referenceable": true,
+              "encrypted": true,
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "tolerance_second": {
+              "description": "Tolerance of the webhook timestamp in seconds. If the webhook timestamp is older than this number of seconds, it will be rejected with a '400' response.",
+              "type": "integer",
+              "gt": -1,
+              "required": true,
+              "default": 300
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/statsd-advanced/3.12.json b/schemas/statsd-advanced/3.12.json
new file mode 100644
index 00000000..bee3b491
--- /dev/null
+++ b/schemas/statsd-advanced/3.12.json
@@ -0,0 +1,457 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string",
+              "default": "localhost"
+            }
+          },
+          {
+            "port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ],
+              "default": 8125
+            }
+          },
+          {
+            "prefix": {
+              "description": "String to prefix to each metric's name.",
+              "type": "string",
+              "default": "kong"
+            }
+          },
+          {
+            "metrics": {
+              "description": "List of Metrics to be logged.",
+              "type": "array",
+              "elements": {
+                "entity_checks": [
+                  {
+                    "conditional": {
+                      "then_field": "stat_type",
+                      "if_match": {
+                        "one_of": [
+                          "unique_users"
+                        ]
+                      },
+                      "then_match": {
+                        "eq": "set"
+                      },
+                      "if_field": "name"
+                    }
+                  },
+                  {
+                    "conditional": {
+                      "then_field": "stat_type",
+                      "if_match": {
+                        "one_of": [
+                          "request_count",
+                          "status_count",
+                          "request_per_user",
+                          "status_count_per_user",
+                          "status_count_per_workspace",
+                          "status_count_per_user_per_route",
+                          "cache_datastore_hits_total",
+                          "cache_datastore_misses_total"
+                        ]
+                      },
+                      "then_match": {
+                        "eq": "counter"
+                      },
+                      "if_field": "name"
+                    }
+                  },
+                  {
+                    "conditional": {
+                      "then_field": "stat_type",
+                      "if_match": {
+                        "one_of": [
+                          "shdict_usage"
+                        ]
+                      },
+                      "then_match": {
+                        "eq": "gauge"
+                      },
+                      "if_field": "name"
+                    }
+                  },
+                  {
+                    "conditional": {
+                      "then_field": "sample_rate",
+                      "if_match": {
+                        "one_of": [
+                          "counter",
+                          "gauge"
+                        ]
+                      },
+                      "then_match": {
+                        "required": true
+                      },
+                      "if_field": "stat_type"
+                    }
+                  }
+                ],
+                "type": "record",
+                "fields": [
+                  {
+                    "name": {
+                      "type": "string",
+                      "one_of": [
+                        "kong_latency",
+                        "latency",
+                        "request_count",
+                        "request_per_user",
+                        "request_size",
+                        "response_size",
+                        "status_count",
+                        "status_count_per_user",
+                        "unique_users",
+                        "upstream_latency",
+                        "status_count_per_workspace",
+                        "status_count_per_user_per_route",
+                        "shdict_usage",
+                        "cache_datastore_hits_total",
+                        "cache_datastore_misses_total"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "stat_type": {
+                      "type": "string",
+                      "one_of": [
+                        "counter",
+                        "gauge",
+                        "histogram",
+                        "meter",
+                        "set",
+                        "timer"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "sample_rate": {
+                      "gt": 0,
+                      "type": "number"
+                    }
+                  },
+                  {
+                    "consumer_identifier": {
+                      "one_of": [
+                        "consumer_id",
+                        "custom_id",
+                        "username"
+                      ],
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "service_identifier": {
+                      "one_of": [
+                        "service_id",
+                        "service_name",
+                        "service_host",
+                        "service_name_or_host"
+                      ],
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "workspace_identifier": {
+                      "one_of": [
+                        "workspace_id",
+                        "workspace_name"
+                      ],
+                      "type": "string"
+                    }
+                  }
+                ]
+              },
+              "default": [
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "request_count"
+                },
+                {
+                  "name": "latency",
+                  "stat_type": "timer"
+                },
+                {
+                  "name": "request_size",
+                  "stat_type": "timer"
+                },
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "status_count"
+                },
+                {
+                  "name": "response_size",
+                  "stat_type": "timer"
+                },
+                {
+                  "name": "unique_users",
+                  "stat_type": "set"
+                },
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "request_per_user"
+                },
+                {
+                  "name": "upstream_latency",
+                  "stat_type": "timer"
+                },
+                {
+                  "name": "kong_latency",
+                  "stat_type": "timer"
+                },
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "status_count_per_user"
+                },
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "status_count_per_workspace"
+                },
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "status_count_per_user_per_route"
+                },
+                {
+                  "stat_type": "gauge",
+                  "sample_rate": 1,
+                  "name": "shdict_usage"
+                },
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "cache_datastore_hits_total"
+                },
+                {
+                  "stat_type": "counter",
+                  "sample_rate": 1,
+                  "name": "cache_datastore_misses_total"
+                }
+              ]
+            }
+          },
+          {
+            "allow_status_codes": {
+              "description": "List of status code ranges that are allowed to be logged in metrics.",
+              "type": "array",
+              "elements": {
+                "match": "^[0-9]+-[0-9]+$",
+                "type": "string"
+              }
+            }
+          },
+          {
+            "udp_packet_size": {
+              "description": "Combine UDP packet up to the size configured. If zero (0), don't combine the UDP packet. Must be a number between 0 and 65507 (inclusive).",
+              "type": "number",
+              "between": [
+                0,
+                65507
+              ],
+              "default": 0
+            }
+          },
+          {
+            "use_tcp": {
+              "description": "Use TCP instead of UDP.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "hostname_in_prefix": {
+              "description": "Include the `hostname` in the `prefix` for each metric name.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "consumer_identifier_default": {
+              "description": "The default consumer identifier for metrics. This will take effect when a metric's consumer identifier is omitted. Allowed values are `custom_id`, `consumer_id`, `username`.",
+              "type": "string",
+              "one_of": [
+                "consumer_id",
+                "custom_id",
+                "username"
+              ],
+              "default": "custom_id",
+              "required": true
+            }
+          },
+          {
+            "service_identifier_default": {
+              "description": "The default service identifier for metrics. This will take effect when a metric's service identifier is omitted. Allowed values are `service_name_or_host`, `service_id`, `service_name`, `service_host`.",
+              "type": "string",
+              "one_of": [
+                "service_id",
+                "service_name",
+                "service_host",
+                "service_name_or_host"
+              ],
+              "default": "service_name_or_host",
+              "required": true
+            }
+          },
+          {
+            "workspace_identifier_default": {
+              "description": "The default workspace identifier for metrics. This will take effect when a metric's workspace identifier is omitted. Allowed values are `workspace_id`, `workspace_name`.   ",
+              "type": "string",
+              "one_of": [
+                "workspace_id",
+                "workspace_name"
+              ],
+              "default": "workspace_id",
+              "required": true
+            }
+          },
+          {
+            "queue": {
+              "type": "record",
+              "fields": [
+                {
+                  "max_batch_size": {
+                    "description": "Maximum number of entries that can be processed at a time.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_coalescing_delay": {
+                    "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.",
+                    "type": "number",
+                    "between": [
+                      0,
+                      3600
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_entries": {
+                    "description": "Maximum number of entries that can be waiting on the queue.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "max_bytes": {
+                    "description": "Maximum number of bytes that can be waiting on a queue, requires string content.",
+                    "type": "integer"
+                  }
+                },
+                {
+                  "max_retry_time": {
+                    "description": "Time in seconds before the queue gives up calling a failed handler for a batch.",
+                    "type": "number",
+                    "default": 60
+                  }
+                },
+                {
+                  "initial_retry_delay": {
+                    "description": "Time in seconds before the initial retry is made for a failing batch.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 0.01
+                  }
+                },
+                {
+                  "max_retry_delay": {
+                    "description": "Maximum time in seconds between retries, caps exponential backoff.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 60
+                  }
+                },
+                {
+                  "concurrency_limit": {
+                    "description": "The number of of queue delivery timers. -1 indicates unlimited.",
+                    "type": "integer",
+                    "one_of": [
+                      -1,
+                      1
+                    ],
+                    "default": 1
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/statsd/3.12.json b/schemas/statsd/3.12.json
new file mode 100644
index 00000000..b986eec0
--- /dev/null
+++ b/schemas/statsd/3.12.json
@@ -0,0 +1,452 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "host": {
+              "description": "The IP address or hostname of StatsD server to send data to.",
+              "type": "string",
+              "default": "localhost"
+            }
+          },
+          {
+            "port": {
+              "description": "The port of StatsD server to send data to.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ],
+              "default": 8125
+            }
+          },
+          {
+            "prefix": {
+              "description": "String to prefix to each metric's name.",
+              "type": "string",
+              "default": "kong"
+            }
+          },
+          {
+            "metrics": {
+              "description": "List of metrics to be logged.",
+              "type": "array",
+              "elements": {
+                "entity_checks": [
+                  {
+                    "conditional": {
+                      "then_field": "sample_rate",
+                      "if_match": {
+                        "one_of": [
+                          "counter",
+                          "gauge"
+                        ]
+                      },
+                      "then_match": {
+                        "required": true
+                      },
+                      "if_field": "stat_type"
+                    }
+                  }
+                ],
+                "type": "record",
+                "fields": [
+                  {
+                    "name": {
+                      "description": "StatsD metric’s name.",
+                      "type": "string",
+                      "one_of": [
+                        "kong_latency",
+                        "latency",
+                        "request_count",
+                        "request_per_user",
+                        "request_size",
+                        "response_size",
+                        "status_count",
+                        "status_count_per_user",
+                        "unique_users",
+                        "upstream_latency",
+                        "status_count_per_workspace",
+                        "status_count_per_user_per_route",
+                        "shdict_usage",
+                        "cache_datastore_hits_total",
+                        "cache_datastore_misses_total"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "stat_type": {
+                      "description": "Determines what sort of event a metric represents.",
+                      "type": "string",
+                      "one_of": [
+                        "counter",
+                        "gauge",
+                        "histogram",
+                        "meter",
+                        "set",
+                        "timer"
+                      ],
+                      "required": true
+                    }
+                  },
+                  {
+                    "sample_rate": {
+                      "description": "Sampling rate",
+                      "type": "number",
+                      "gt": 0
+                    }
+                  },
+                  {
+                    "consumer_identifier": {
+                      "description": "Authenticated user detail.",
+                      "type": "string",
+                      "one_of": [
+                        "consumer_id",
+                        "custom_id",
+                        "username"
+                      ]
+                    }
+                  },
+                  {
+                    "service_identifier": {
+                      "description": "Service detail.",
+                      "type": "string",
+                      "one_of": [
+                        "service_id",
+                        "service_name",
+                        "service_host",
+                        "service_name_or_host"
+                      ]
+                    }
+                  },
+                  {
+                    "workspace_identifier": {
+                      "description": "Workspace detail.",
+                      "type": "string",
+                      "one_of": [
+                        "workspace_id",
+                        "workspace_name"
+                      ]
+                    }
+                  }
+                ]
+              },
+              "default": [
+                {
+                  "stat_type": "counter",
+                  "name": "request_count",
+                  "sample_rate": 1
+                },
+                {
+                  "name": "latency",
+                  "stat_type": "timer"
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "request_size",
+                  "sample_rate": 1
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "status_count",
+                  "sample_rate": 1
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "response_size",
+                  "sample_rate": 1
+                },
+                {
+                  "name": "unique_users",
+                  "stat_type": "set"
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "request_per_user",
+                  "sample_rate": 1
+                },
+                {
+                  "name": "upstream_latency",
+                  "stat_type": "timer"
+                },
+                {
+                  "name": "kong_latency",
+                  "stat_type": "timer"
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "status_count_per_user",
+                  "sample_rate": 1
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "status_count_per_workspace",
+                  "sample_rate": 1
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "status_count_per_user_per_route",
+                  "sample_rate": 1
+                },
+                {
+                  "stat_type": "gauge",
+                  "name": "shdict_usage",
+                  "sample_rate": 1
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "cache_datastore_hits_total",
+                  "sample_rate": 1
+                },
+                {
+                  "stat_type": "counter",
+                  "name": "cache_datastore_misses_total",
+                  "sample_rate": 1
+                }
+              ]
+            }
+          },
+          {
+            "allow_status_codes": {
+              "description": "List of status code ranges that are allowed to be logged in metrics.",
+              "type": "array",
+              "elements": {
+                "match": "^[0-9]+-[0-9]+$",
+                "type": "string"
+              }
+            }
+          },
+          {
+            "udp_packet_size": {
+              "type": "number",
+              "between": [
+                0,
+                65507
+              ],
+              "default": 0
+            }
+          },
+          {
+            "use_tcp": {
+              "default": false,
+              "type": "boolean"
+            }
+          },
+          {
+            "hostname_in_prefix": {
+              "default": false,
+              "type": "boolean"
+            }
+          },
+          {
+            "consumer_identifier_default": {
+              "default": "custom_id",
+              "type": "string",
+              "one_of": [
+                "consumer_id",
+                "custom_id",
+                "username"
+              ],
+              "required": true
+            }
+          },
+          {
+            "service_identifier_default": {
+              "default": "service_name_or_host",
+              "type": "string",
+              "one_of": [
+                "service_id",
+                "service_name",
+                "service_host",
+                "service_name_or_host"
+              ],
+              "required": true
+            }
+          },
+          {
+            "workspace_identifier_default": {
+              "default": "workspace_id",
+              "type": "string",
+              "one_of": [
+                "workspace_id",
+                "workspace_name"
+              ],
+              "required": true
+            }
+          },
+          {
+            "retry_count": {
+              "type": "integer",
+              "deprecation": {
+                "old_default": 10,
+                "removal_in_version": "4.0",
+                "message": "statsd: config.retry_count no longer works, please use config.queue.max_retry_time instead"
+              }
+            }
+          },
+          {
+            "queue_size": {
+              "type": "integer",
+              "deprecation": {
+                "old_default": 1,
+                "removal_in_version": "4.0",
+                "message": "statsd: config.queue_size is deprecated, please use config.queue.max_batch_size instead"
+              }
+            }
+          },
+          {
+            "flush_timeout": {
+              "type": "number",
+              "deprecation": {
+                "old_default": 2,
+                "removal_in_version": "4.0",
+                "message": "statsd: config.flush_timeout is deprecated, please use config.queue.max_coalescing_delay instead"
+              }
+            }
+          },
+          {
+            "tag_style": {
+              "type": "string",
+              "one_of": [
+                "dogstatsd",
+                "influxdb",
+                "librato",
+                "signalfx"
+              ],
+              "required": false
+            }
+          },
+          {
+            "queue": {
+              "type": "record",
+              "fields": [
+                {
+                  "max_batch_size": {
+                    "description": "Maximum number of entries that can be processed at a time.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_coalescing_delay": {
+                    "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.",
+                    "type": "number",
+                    "between": [
+                      0,
+                      3600
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_entries": {
+                    "description": "Maximum number of entries that can be waiting on the queue.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "max_bytes": {
+                    "description": "Maximum number of bytes that can be waiting on a queue, requires string content.",
+                    "type": "integer"
+                  }
+                },
+                {
+                  "max_retry_time": {
+                    "description": "Time in seconds before the queue gives up calling a failed handler for a batch.",
+                    "type": "number",
+                    "default": 60
+                  }
+                },
+                {
+                  "initial_retry_delay": {
+                    "description": "Time in seconds before the initial retry is made for a failing batch.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 0.01
+                  }
+                },
+                {
+                  "max_retry_delay": {
+                    "description": "Maximum time in seconds between retries, caps exponential backoff.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 60
+                  }
+                },
+                {
+                  "concurrency_limit": {
+                    "description": "The number of of queue delivery timers. -1 indicates unlimited.",
+                    "type": "integer",
+                    "one_of": [
+                      -1,
+                      1
+                    ],
+                    "default": 1
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/syslog/3.12.json b/schemas/syslog/3.12.json
new file mode 100644
index 00000000..44f13098
--- /dev/null
+++ b/schemas/syslog/3.12.json
@@ -0,0 +1,162 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "log_level": {
+              "default": "info",
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "required": true
+            }
+          },
+          {
+            "successful_severity": {
+              "default": "info",
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "required": true
+            }
+          },
+          {
+            "client_errors_severity": {
+              "default": "info",
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "required": true
+            }
+          },
+          {
+            "server_errors_severity": {
+              "default": "info",
+              "type": "string",
+              "one_of": [
+                "debug",
+                "info",
+                "notice",
+                "warning",
+                "err",
+                "crit",
+                "alert",
+                "emerg"
+              ],
+              "required": true
+            }
+          },
+          {
+            "custom_fields_by_lua": {
+              "keys": {
+                "type": "string",
+                "len_min": 1
+              },
+              "type": "map",
+              "values": {
+                "type": "string",
+                "len_min": 1
+              },
+              "description": "Lua code as a key-value map"
+            }
+          },
+          {
+            "facility": {
+              "description": "The facility is used by the operating system to decide how to handle each log message.",
+              "type": "string",
+              "one_of": [
+                "auth",
+                "authpriv",
+                "cron",
+                "daemon",
+                "ftp",
+                "kern",
+                "lpr",
+                "mail",
+                "news",
+                "syslog",
+                "user",
+                "uucp",
+                "local0",
+                "local1",
+                "local2",
+                "local3",
+                "local4",
+                "local5",
+                "local6",
+                "local7"
+              ],
+              "default": "user",
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/tcp-log/3.12.json b/schemas/tcp-log/3.12.json
new file mode 100644
index 00000000..7e7dabac
--- /dev/null
+++ b/schemas/tcp-log/3.12.json
@@ -0,0 +1,110 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "host": {
+              "description": "The IP address or host name to send data to.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "port": {
+              "description": "The port to send data to on the upstream server.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ],
+              "required": true
+            }
+          },
+          {
+            "timeout": {
+              "description": "An optional timeout in milliseconds when sending data to the upstream server.",
+              "type": "number",
+              "default": 10000
+            }
+          },
+          {
+            "keepalive": {
+              "description": "An optional value in milliseconds that defines how long an idle connection lives before being closed.",
+              "type": "number",
+              "default": 60000
+            }
+          },
+          {
+            "tls": {
+              "description": "Indicates whether to perform a TLS handshake against the remote server.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "tls_sni": {
+              "description": "An optional string that defines the SNI (Server Name Indication) hostname to send in the TLS handshake.",
+              "type": "string"
+            }
+          },
+          {
+            "custom_fields_by_lua": {
+              "description": "A list of key-value pairs, where the key is the name of a log field and the value is a chunk of Lua code, whose return value sets or replaces the log field value.",
+              "type": "map",
+              "values": {
+                "type": "string",
+                "len_min": 1
+              },
+              "keys": {
+                "type": "string",
+                "len_min": 1
+              }
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/tls-handshake-modifier/3.12.json b/schemas/tls-handshake-modifier/3.12.json
new file mode 100644
index 00000000..727c8436
--- /dev/null
+++ b/schemas/tls-handshake-modifier/3.12.json
@@ -0,0 +1,58 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "https",
+            "grpcs",
+            "tls"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "https",
+          "grpcs"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "tls_client_certificate": {
+              "description": "TLS Client Certificate",
+              "type": "string",
+              "one_of": [
+                "REQUEST"
+              ],
+              "default": "REQUEST",
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/tls-metadata-headers/3.12.json b/schemas/tls-metadata-headers/3.12.json
new file mode 100644
index 00000000..9207417a
--- /dev/null
+++ b/schemas/tls-metadata-headers/3.12.json
@@ -0,0 +1,94 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "https",
+            "grpcs",
+            "tls"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "https",
+          "grpcs"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "inject_client_cert_details": {
+              "description": "Enables TLS client certificate metadata values to be injected into HTTP headers.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "client_cert_header_name": {
+              "description": "Define the HTTP header name used for the PEM format URL encoded client certificate.",
+              "type": "string",
+              "required": true,
+              "default": "X-Client-Cert"
+            }
+          },
+          {
+            "client_serial_header_name": {
+              "description": "Define the HTTP header name used for the serial number of the client certificate.",
+              "type": "string",
+              "required": true,
+              "default": "X-Client-Cert-Serial"
+            }
+          },
+          {
+            "client_cert_issuer_dn_header_name": {
+              "description": "Define the HTTP header name used for the issuer DN of the client certificate.",
+              "type": "string",
+              "required": true,
+              "default": "X-Client-Cert-Issuer-DN"
+            }
+          },
+          {
+            "client_cert_subject_dn_header_name": {
+              "description": "Define the HTTP header name used for the subject DN of the client certificate.",
+              "type": "string",
+              "required": true,
+              "default": "X-Client-Cert-Subject-DN"
+            }
+          },
+          {
+            "client_cert_fingerprint_header_name": {
+              "description": "Define the HTTP header name used for the SHA1 fingerprint of the client certificate.",
+              "type": "string",
+              "required": true,
+              "default": "X-Client-Cert-Fingerprint"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/udp-log/3.12.json b/schemas/udp-log/3.12.json
new file mode 100644
index 00000000..ca7f91e7
--- /dev/null
+++ b/schemas/udp-log/3.12.json
@@ -0,0 +1,89 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "host": {
+              "description": "A string representing a host name, such as example.com.",
+              "type": "string",
+              "required": true
+            }
+          },
+          {
+            "port": {
+              "description": "An integer representing a port number between 0 and 65535, inclusive.",
+              "type": "integer",
+              "between": [
+                0,
+                65535
+              ],
+              "required": true
+            }
+          },
+          {
+            "timeout": {
+              "description": "An optional timeout in milliseconds when sending data to the upstream server.",
+              "type": "number",
+              "default": 10000
+            }
+          },
+          {
+            "custom_fields_by_lua": {
+              "keys": {
+                "type": "string",
+                "len_min": 1
+              },
+              "type": "map",
+              "values": {
+                "type": "string",
+                "len_min": 1
+              },
+              "description": "Lua code as a key-value map"
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/upstream-oauth/3.12.json b/schemas/upstream-oauth/3.12.json
new file mode 100644
index 00000000..3deb0da8
--- /dev/null
+++ b/schemas/upstream-oauth/3.12.json
@@ -0,0 +1,765 @@
+{
+  "entity_checks": [
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    },
+    {
+      "custom_entity_check": {
+        "field_sources": [
+          "config"
+        ]
+      }
+    }
+  ],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "client": {
+              "type": "record",
+              "fields": [
+                {
+                  "auth_method": {
+                    "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.",
+                    "type": "string",
+                    "one_of": [
+                      "client_secret_post",
+                      "client_secret_basic",
+                      "client_secret_jwt",
+                      "none"
+                    ],
+                    "required": true,
+                    "default": "client_secret_post"
+                  }
+                },
+                {
+                  "client_secret_jwt_alg": {
+                    "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.",
+                    "type": "string",
+                    "one_of": [
+                      "HS512",
+                      "HS256"
+                    ],
+                    "required": true,
+                    "default": "HS512"
+                  }
+                },
+                {
+                  "http_version": {
+                    "description": "The HTTP version used for requests made by this plugin. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.",
+                    "type": "number",
+                    "default": 1.1,
+                    "required": false
+                  }
+                },
+                {
+                  "http_proxy": {
+                    "description": "The proxy to use when making HTTP requests to the IdP.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "http_proxy_authorization": {
+                    "description": "The `Proxy-Authorization` header value to be used with `http_proxy`.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "https_proxy": {
+                    "description": "The proxy to use when making HTTPS requests to the IdP.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "https_proxy_authorization": {
+                    "description": "The `Proxy-Authorization` header value to be used with `https_proxy`.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "no_proxy": {
+                    "description": "A comma-separated list of hosts that should not be proxied.",
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "timeout": {
+                    "description": "Network I/O timeout for requests to the IdP in milliseconds.",
+                    "type": "integer",
+                    "required": true,
+                    "between": [
+                      0,
+                      2147483646
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "keep_alive": {
+                    "description": "Whether to use keepalive connections to the IdP.",
+                    "type": "boolean",
+                    "default": true,
+                    "required": true
+                  }
+                },
+                {
+                  "ssl_verify": {
+                    "description": "Whether to verify the certificate presented by the IdP when using HTTPS.",
+                    "type": "boolean",
+                    "default": false,
+                    "required": false
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "oauth": {
+              "type": "record",
+              "fields": [
+                {
+                  "token_endpoint": {
+                    "description": "The token endpoint URI.",
+                    "type": "string",
+                    "required": true
+                  }
+                },
+                {
+                  "token_headers": {
+                    "description": "Extra headers to be passed in the token endpoint request.",
+                    "type": "map",
+                    "values": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "keys": {
+                      "description": "A string representing an HTTP header name.",
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "token_post_args": {
+                    "description": "Extra post arguments to be passed in the token endpoint request.",
+                    "type": "map",
+                    "values": {
+                      "referenceable": true,
+                      "type": "string"
+                    },
+                    "keys": {
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "grant_type": {
+                    "description": "The OAuth grant type to be used.",
+                    "type": "string",
+                    "one_of": [
+                      "client_credentials",
+                      "password"
+                    ],
+                    "required": true,
+                    "default": "client_credentials"
+                  }
+                },
+                {
+                  "client_id": {
+                    "description": "The client ID for the application registration in the IdP.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "client_secret": {
+                    "description": "The client secret for the application registration in the IdP.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "username": {
+                    "description": "The username to use if `config.oauth.grant_type` is set to `password`.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "password": {
+                    "description": "The password to use if `config.oauth.grant_type` is set to `password`.",
+                    "referenceable": true,
+                    "encrypted": true,
+                    "type": "string",
+                    "required": false
+                  }
+                },
+                {
+                  "scopes": {
+                    "description": "List of scopes to request from the IdP when obtaining a new token.",
+                    "type": "array",
+                    "required": false,
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": [
+                      "openid"
+                    ]
+                  }
+                },
+                {
+                  "audience": {
+                    "description": "List of audiences passed to the IdP when obtaining a new token.",
+                    "type": "array",
+                    "required": false,
+                    "elements": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "cache": {
+              "type": "record",
+              "fields": [
+                {
+                  "strategy": {
+                    "description": "The method Kong should use to cache tokens issued by the IdP.",
+                    "type": "string",
+                    "one_of": [
+                      "memory",
+                      "redis"
+                    ],
+                    "required": true,
+                    "default": "memory"
+                  }
+                },
+                {
+                  "memory": {
+                    "type": "record",
+                    "fields": [
+                      {
+                        "dictionary_name": {
+                          "description": "The shared dictionary used by the plugin to cache tokens if `config.cache.strategy` is set to `memory`.",
+                          "type": "string",
+                          "default": "kong_db_cache",
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "redis": {
+                    "entity_checks": [
+                      {
+                        "mutually_required": [
+                          "host",
+                          "port"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "sentinel_master",
+                          "sentinel_role",
+                          "sentinel_nodes"
+                        ]
+                      },
+                      {
+                        "mutually_required": [
+                          "connect_timeout",
+                          "send_timeout",
+                          "read_timeout"
+                        ]
+                      },
+                      {
+                        "conditional": {
+                          "then_field": "host",
+                          "if_match": {
+                            "eq": true
+                          },
+                          "then_match": {
+                            "required": true
+                          },
+                          "if_field": "connection_is_proxied"
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "database",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "cluster_nodes",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      },
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "sentinel_role",
+                            "connection_is_proxied"
+                          ],
+                          "run_with_missing_fields": true
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "shorthand_fields": [
+                      {
+                        "timeout": {
+                          "deprecation": {
+                            "message": "redis schema field `timeout` is deprecated, use `connect_timeout`, `send_timeout` and `read_timeout`",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "connect_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "send_timeout"
+                                ]
+                              },
+                              {
+                                "path": [
+                                  "read_timeout"
+                                ]
+                              }
+                            ]
+                          },
+                          "type": "integer"
+                        }
+                      },
+                      {
+                        "sentinel_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "sentinel_addresses is deprecated, please use sentinel_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "sentinel_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      },
+                      {
+                        "cluster_addresses": {
+                          "len_min": 1,
+                          "type": "array",
+                          "elements": {
+                            "type": "string"
+                          },
+                          "deprecation": {
+                            "message": "cluster_addresses is deprecated, please use cluster_nodes instead",
+                            "removal_in_version": "4.0",
+                            "replaced_with": [
+                              {
+                                "path": [
+                                  "cluster_nodes"
+                                ]
+                              }
+                            ]
+                          }
+                        }
+                      }
+                    ],
+                    "fields": [
+                      {
+                        "host": {
+                          "description": "A string representing a host name, such as example.com.",
+                          "type": "string",
+                          "default": "127.0.0.1"
+                        }
+                      },
+                      {
+                        "port": {
+                          "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            65535
+                          ],
+                          "default": 6379
+                        }
+                      },
+                      {
+                        "connect_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "send_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "read_timeout": {
+                          "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ],
+                          "default": 2000
+                        }
+                      },
+                      {
+                        "username": {
+                          "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "password": {
+                          "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_username": {
+                          "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.",
+                          "type": "string",
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "sentinel_password": {
+                          "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.",
+                          "type": "string",
+                          "encrypted": true,
+                          "referenceable": true
+                        }
+                      },
+                      {
+                        "database": {
+                          "description": "Database to use for the Redis connection when using the `redis` strategy",
+                          "type": "integer",
+                          "default": 0
+                        }
+                      },
+                      {
+                        "keepalive_pool_size": {
+                          "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.",
+                          "type": "integer",
+                          "between": [
+                            1,
+                            2147483646
+                          ],
+                          "default": 256
+                        }
+                      },
+                      {
+                        "keepalive_backlog": {
+                          "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.",
+                          "type": "integer",
+                          "between": [
+                            0,
+                            2147483646
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_master": {
+                          "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.",
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "sentinel_role": {
+                          "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.",
+                          "type": "string",
+                          "one_of": [
+                            "master",
+                            "slave",
+                            "any"
+                          ]
+                        }
+                      },
+                      {
+                        "sentinel_nodes": {
+                          "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "host": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_nodes": {
+                          "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.",
+                          "type": "array",
+                          "len_min": 1,
+                          "elements": {
+                            "fields": [
+                              {
+                                "ip": {
+                                  "description": "A string representing a host name, such as example.com.",
+                                  "type": "string",
+                                  "required": true,
+                                  "default": "127.0.0.1"
+                                }
+                              },
+                              {
+                                "port": {
+                                  "description": "An integer representing a port number between 0 and 65535, inclusive.",
+                                  "type": "integer",
+                                  "between": [
+                                    0,
+                                    65535
+                                  ],
+                                  "default": 6379
+                                }
+                              }
+                            ],
+                            "type": "record"
+                          },
+                          "required": false
+                        }
+                      },
+                      {
+                        "ssl": {
+                          "description": "If set to true, uses SSL to connect to Redis.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "ssl_verify": {
+                          "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      },
+                      {
+                        "server_name": {
+                          "description": "A string representing an SNI (server name indication) value for TLS.",
+                          "type": "string",
+                          "required": false
+                        }
+                      },
+                      {
+                        "cluster_max_redirections": {
+                          "description": "Maximum retry attempts for redirection.",
+                          "type": "integer",
+                          "default": 5,
+                          "required": false
+                        }
+                      },
+                      {
+                        "connection_is_proxied": {
+                          "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.",
+                          "type": "boolean",
+                          "required": false,
+                          "default": false
+                        }
+                      }
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "eagerly_expire": {
+                    "description": "The number of seconds to eagerly expire a cached token. By default, a cached token expires 5 seconds before its lifetime as defined in `expires_in`.",
+                    "type": "integer",
+                    "gt": -1,
+                    "default": 5,
+                    "required": true
+                  }
+                },
+                {
+                  "default_ttl": {
+                    "description": "The lifetime of a token without an explicit `expires_in` value.",
+                    "type": "number",
+                    "gt": 0,
+                    "default": 3600
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "behavior": {
+              "type": "record",
+              "fields": [
+                {
+                  "upstream_access_token_header_name": {
+                    "description": "The name of the header used to send the access token (obtained from the IdP) to the upstream service.",
+                    "type": "string",
+                    "len_min": 0,
+                    "default": "Authorization",
+                    "required": true
+                  }
+                },
+                {
+                  "idp_error_response_status_code": {
+                    "description": "The response code to return to the consumer if Kong fails to obtain a token from the IdP.",
+                    "type": "integer",
+                    "default": 502,
+                    "between": [
+                      500,
+                      599
+                    ],
+                    "required": true
+                  }
+                },
+                {
+                  "idp_error_response_content_type": {
+                    "description": "The Content-Type of the response to return to the consumer if Kong fails to obtain a token from the IdP.",
+                    "type": "string",
+                    "len_min": 0,
+                    "default": "application/json; charset=utf-8",
+                    "required": true
+                  }
+                },
+                {
+                  "idp_error_response_message": {
+                    "description": "The message to embed in the body of the response to return to the consumer if Kong fails to obtain a token from the IdP.",
+                    "type": "string",
+                    "len_min": 0,
+                    "default": "Failed to authenticate request to upstream",
+                    "required": true
+                  }
+                },
+                {
+                  "idp_error_response_body_template": {
+                    "description": "The template to use to create the body of the response to return to the consumer if Kong fails to obtain a token from the IdP.",
+                    "type": "string",
+                    "len_min": 0,
+                    "default": "{ \"code\": \"{{status}}\", \"message\": \"{{message}}\" }",
+                    "required": true
+                  }
+                },
+                {
+                  "purge_token_on_upstream_status_codes": {
+                    "description": "An array of status codes which will force an access token to be purged when returned by the upstream. An empty array will disable this functionality.",
+                    "type": "array",
+                    "elements": {
+                      "between": [
+                        100,
+                        599
+                      ],
+                      "type": "integer"
+                    },
+                    "default": [
+                      401
+                    ]
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ],
+  "supported_partials": {
+    "redis-ee": [
+      "config.cache.redis"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/schemas/upstream-timeout/3.12.json b/schemas/upstream-timeout/3.12.json
new file mode 100644
index 00000000..cac6a1ed
--- /dev/null
+++ b/schemas/upstream-timeout/3.12.json
@@ -0,0 +1,73 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "read_timeout": {
+              "description": "The timeout in milliseconds between two successive read operations for transmitting a request to the upstream server. Must be an integer between 1 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ]
+            }
+          },
+          {
+            "send_timeout": {
+              "description": "The timeout in milliseconds between two successive write operations for transmitting a request to the upstream server. Must be an integer between 1 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ]
+            }
+          },
+          {
+            "connect_timeout": {
+              "description": "The timeout in milliseconds for establishing a connection to the upstream server. Must be an integer between 1 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ]
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/vault-auth/3.12.json b/schemas/vault-auth/3.12.json
new file mode 100644
index 00000000..7883b30f
--- /dev/null
+++ b/schemas/vault-auth/3.12.json
@@ -0,0 +1,110 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "consumer": {
+        "eq": null,
+        "reference": "consumers",
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "access_token_name": {
+              "description": "Describes an array of comma-separated parameter names where the plugin looks for an access token. The client must send the access token in one of those key names, and the plugin will try to read the credential from a header or the querystring parameter with the same name. The key names can only contain [a-z], [A-Z], [0-9], [_], and [-].",
+              "type": "string",
+              "default": "access_token",
+              "elements": {
+                "description": "A string representing an HTTP header name.",
+                "type": "string"
+              },
+              "required": true
+            }
+          },
+          {
+            "secret_token_name": {
+              "description": "Describes an array of comma-separated parameter names where the plugin looks for a secret token. The client must send the secret in one of those key names, and the plugin will try to read the credential from a header or the querystring parameter with the same name. The key names can only contain [a-z], [A-Z], [0-9], [_], and [-].",
+              "type": "string",
+              "default": "secret_token",
+              "elements": {
+                "description": "A string representing an HTTP header name.",
+                "type": "string"
+              },
+              "required": true
+            }
+          },
+          {
+            "vault": {
+              "description": "A reference to an existing `vault` object within the database. `vault` entities define the connection and authentication parameters used to connect to a Vault HTTP(S) API.",
+              "reference": "vault_auth_vaults",
+              "type": "foreign",
+              "required": true
+            }
+          },
+          {
+            "hide_credentials": {
+              "description": "An optional boolean value telling the plugin to show or hide the credential from the upstream service. If `true`, the plugin will strip the credential from the request (i.e. the header or querystring containing the key) before proxying it.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "anonymous": {
+              "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
+              "type": "string"
+            }
+          },
+          {
+            "tokens_in_body": {
+              "description": "If enabled, the plugin will read the request body (if said request has one and its MIME type is supported) and try to find the key in it. Supported MIME types are `application/www-form-urlencoded`, `application/json`, and `multipart/form-data`.",
+              "type": "boolean",
+              "default": false
+            }
+          },
+          {
+            "run_on_preflight": {
+              "description": "A boolean value that indicates whether the plugin should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests will always be allowed.",
+              "type": "boolean",
+              "default": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/websocket-size-limit/3.12.json b/schemas/websocket-size-limit/3.12.json
new file mode 100644
index 00000000..6d534d14
--- /dev/null
+++ b/schemas/websocket-size-limit/3.12.json
@@ -0,0 +1,66 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "client_max_payload",
+              "upstream_max_payload"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "client_max_payload": {
+              "type": "integer",
+              "between": [
+                1,
+                33554432
+              ],
+              "required": false
+            }
+          },
+          {
+            "upstream_max_payload": {
+              "type": "integer",
+              "between": [
+                1,
+                33554432
+              ],
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/websocket-validator/3.12.json b/schemas/websocket-validator/3.12.json
new file mode 100644
index 00000000..f0a8e750
--- /dev/null
+++ b/schemas/websocket-validator/3.12.json
@@ -0,0 +1,218 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "required": true,
+        "type": "set",
+        "elements": {
+          "one_of": [
+            "ws",
+            "wss"
+          ],
+          "type": "string"
+        },
+        "default": [
+          "ws",
+          "wss"
+        ]
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "at_least_one_of": [
+              "client",
+              "upstream"
+            ]
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "client": {
+              "entity_checks": [
+                {
+                  "at_least_one_of": [
+                    "text",
+                    "binary"
+                  ]
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "text": {
+                    "entity_checks": [
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "type",
+                            "schema"
+                          ]
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "fields": [
+                      {
+                        "type": {
+                          "description": "The corresponding validation library for `config.upstream.binary.schema`. Currently, only `draft4` is supported.",
+                          "type": "string",
+                          "one_of": [
+                            "draft4"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "schema": {
+                          "description": "Schema used to validate upstream-originated binary frames. The semantics of this field depend on the validation type set by `config.upstream.binary.type`.",
+                          "type": "string",
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "binary": {
+                    "entity_checks": [
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "type",
+                            "schema"
+                          ]
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "fields": [
+                      {
+                        "type": {
+                          "description": "The corresponding validation library for `config.upstream.binary.schema`. Currently, only `draft4` is supported.",
+                          "type": "string",
+                          "one_of": [
+                            "draft4"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "schema": {
+                          "description": "Schema used to validate upstream-originated binary frames. The semantics of this field depend on the validation type set by `config.upstream.binary.type`.",
+                          "type": "string",
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": false
+            }
+          },
+          {
+            "upstream": {
+              "entity_checks": [
+                {
+                  "at_least_one_of": [
+                    "text",
+                    "binary"
+                  ]
+                }
+              ],
+              "type": "record",
+              "fields": [
+                {
+                  "text": {
+                    "entity_checks": [
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "type",
+                            "schema"
+                          ]
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "fields": [
+                      {
+                        "type": {
+                          "description": "The corresponding validation library for `config.upstream.binary.schema`. Currently, only `draft4` is supported.",
+                          "type": "string",
+                          "one_of": [
+                            "draft4"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "schema": {
+                          "description": "Schema used to validate upstream-originated binary frames. The semantics of this field depend on the validation type set by `config.upstream.binary.type`.",
+                          "type": "string",
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                },
+                {
+                  "binary": {
+                    "entity_checks": [
+                      {
+                        "custom_entity_check": {
+                          "field_sources": [
+                            "type",
+                            "schema"
+                          ]
+                        }
+                      }
+                    ],
+                    "type": "record",
+                    "fields": [
+                      {
+                        "type": {
+                          "description": "The corresponding validation library for `config.upstream.binary.schema`. Currently, only `draft4` is supported.",
+                          "type": "string",
+                          "one_of": [
+                            "draft4"
+                          ],
+                          "required": true
+                        }
+                      },
+                      {
+                        "schema": {
+                          "description": "Schema used to validate upstream-originated binary frames. The semantics of this field depend on the validation type set by `config.upstream.binary.type`.",
+                          "type": "string",
+                          "required": true
+                        }
+                      }
+                    ],
+                    "required": false
+                  }
+                }
+              ],
+              "required": false
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/xml-threat-protection/3.12.json b/schemas/xml-threat-protection/3.12.json
new file mode 100644
index 00000000..d804b08b
--- /dev/null
+++ b/schemas/xml-threat-protection/3.12.json
@@ -0,0 +1,296 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing HTTP protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https"
+          ],
+          "type": "string"
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "entity_checks": [
+          {
+            "conditional": {
+              "then_field": "max_namespaces",
+              "if_match": {
+                "eq": true
+              },
+              "then_match": {
+                "required": true
+              },
+              "if_field": "namespace_aware"
+            }
+          },
+          {
+            "conditional": {
+              "then_field": "prefix",
+              "if_match": {
+                "eq": true
+              },
+              "then_match": {
+                "required": true
+              },
+              "if_field": "namespace_aware"
+            }
+          },
+          {
+            "conditional": {
+              "then_field": "namespaceuri",
+              "if_match": {
+                "eq": true
+              },
+              "then_match": {
+                "required": true
+              },
+              "if_field": "namespace_aware"
+            }
+          }
+        ],
+        "type": "record",
+        "fields": [
+          {
+            "checked_content_types": {
+              "description": "A list of Content-Type values with payloads that must be validated.",
+              "type": "set",
+              "required": true,
+              "elements": {
+                "type": "string",
+                "match": "^[^%s]+%/[^ ;]+$",
+                "required": true
+              },
+              "default": [
+                "application/xml"
+              ]
+            }
+          },
+          {
+            "allowed_content_types": {
+              "description": "A list of Content-Type values with payloads that are allowed, but aren't validated.",
+              "type": "set",
+              "required": true,
+              "elements": {
+                "type": "string",
+                "match": "^[^%s]+%/[^ ;]+$",
+                "required": true
+              },
+              "default": []
+            }
+          },
+          {
+            "allow_dtd": {
+              "description": "Indicates whether an XML Document Type Definition (DTD) section is allowed.",
+              "type": "boolean",
+              "default": false,
+              "required": true
+            }
+          },
+          {
+            "namespace_aware": {
+              "description": "If not parsing namespace aware, all prefixes and namespace attributes will be counted as regular attributes and element names, and validated as such.",
+              "type": "boolean",
+              "default": true,
+              "required": true
+            }
+          },
+          {
+            "max_depth": {
+              "description": "Maximum depth of tags. Child elements such as Text or Comments are not counted as another level.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 50
+            }
+          },
+          {
+            "max_children": {
+              "description": "Maximum number of children allowed (Element, Text, Comment, ProcessingInstruction, CDATASection). Note: Adjacent text and CDATA sections are counted as one. For example, text-cdata-text-cdata is one child.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 100
+            }
+          },
+          {
+            "max_attributes": {
+              "description": "Maximum number of attributes allowed on a tag, including default ones. Note: If namespace-aware parsing is disabled, then the namespaces definitions are counted as attributes.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 100
+            }
+          },
+          {
+            "max_namespaces": {
+              "description": "Maximum number of namespaces defined on a tag. This value is required if parsing is namespace-aware.",
+              "type": "integer",
+              "gt": 0,
+              "required": false,
+              "default": 20
+            }
+          },
+          {
+            "document": {
+              "description": "Maximum size of the entire document.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 10485760
+            }
+          },
+          {
+            "buffer": {
+              "description": "Maximum size of the unparsed buffer (see below).",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1048576
+            }
+          },
+          {
+            "comment": {
+              "description": "Maximum size of comments.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1024
+            }
+          },
+          {
+            "localname": {
+              "description": "Maximum size of the localname. This applies to tags and attributes.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1024
+            }
+          },
+          {
+            "prefix": {
+              "description": "Maximum size of the prefix. This applies to tags and attributes. This value is required if parsing is namespace-aware.",
+              "type": "integer",
+              "gt": 0,
+              "required": false,
+              "default": 1024
+            }
+          },
+          {
+            "namespaceuri": {
+              "description": "Maximum size of the namespace URI. This value is required if parsing is namespace-aware.",
+              "type": "integer",
+              "gt": 0,
+              "required": false,
+              "default": 1024
+            }
+          },
+          {
+            "attribute": {
+              "description": "Maximum size of the attribute value.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1048576
+            }
+          },
+          {
+            "text": {
+              "description": "Maximum text inside tags (counted over all adjacent text/CDATA elements combined).",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1048576
+            }
+          },
+          {
+            "pitarget": {
+              "description": "Maximum size of processing instruction targets.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1024
+            }
+          },
+          {
+            "pidata": {
+              "description": "Maximum size of processing instruction data.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1024
+            }
+          },
+          {
+            "entityname": {
+              "description": "Maximum size of entity names in EntityDecl.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1024
+            }
+          },
+          {
+            "entity": {
+              "description": "Maximum size of entity values in EntityDecl.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1024
+            }
+          },
+          {
+            "entityproperty": {
+              "description": "Maximum size of systemId, publicId, or notationName in EntityDecl.",
+              "type": "integer",
+              "gt": 0,
+              "required": true,
+              "default": 1024
+            }
+          },
+          {
+            "bla_max_amplification": {
+              "description": "Sets the maximum allowed amplification. This protects against the Billion Laughs Attack.",
+              "type": "number",
+              "gt": 1,
+              "required": true,
+              "default": 100
+            }
+          },
+          {
+            "bla_threshold": {
+              "description": "Sets the threshold after which the protection starts. This protects against the Billion Laughs Attack.",
+              "type": "integer",
+              "gt": 1024,
+              "required": true,
+              "default": 8388608
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/schemas/zipkin/3.12.json b/schemas/zipkin/3.12.json
new file mode 100644
index 00000000..8f74597d
--- /dev/null
+++ b/schemas/zipkin/3.12.json
@@ -0,0 +1,424 @@
+{
+  "entity_checks": [],
+  "fields": [
+    {
+      "protocols": {
+        "description": "A set of strings representing protocols.",
+        "type": "set",
+        "default": [
+          "grpc",
+          "grpcs",
+          "http",
+          "https"
+        ],
+        "elements": {
+          "description": "A string representing a protocol, such as HTTP or HTTPS.",
+          "type": "string",
+          "one_of": [
+            "grpc",
+            "grpcs",
+            "http",
+            "https",
+            "tcp",
+            "tls",
+            "tls_passthrough",
+            "udp",
+            "ws",
+            "wss"
+          ]
+        },
+        "required": true
+      }
+    },
+    {
+      "consumer_group": {
+        "description": "Custom type for representing a foreign key with a null value allowed.",
+        "reference": "consumer_groups",
+        "eq": null,
+        "type": "foreign"
+      }
+    },
+    {
+      "config": {
+        "type": "record",
+        "fields": [
+          {
+            "local_service_name": {
+              "description": "The name of the service as displayed in Zipkin.",
+              "type": "string",
+              "required": true,
+              "default": "kong"
+            }
+          },
+          {
+            "http_endpoint": {
+              "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.",
+              "type": "string"
+            }
+          },
+          {
+            "sample_ratio": {
+              "description": "How often to sample requests that do not contain trace IDs. Set to `0` to turn sampling off, or to `1` to sample **all** requests. ",
+              "type": "number",
+              "between": [
+                0,
+                1
+              ],
+              "default": 0.001
+            }
+          },
+          {
+            "default_service_name": {
+              "description": "Set a default service name to override `unknown-service-name` in the Zipkin spans.",
+              "type": "string"
+            }
+          },
+          {
+            "include_credential": {
+              "description": "Specify whether the credential of the currently authenticated consumer should be included in metadata sent to the Zipkin server.",
+              "type": "boolean",
+              "required": true,
+              "default": true
+            }
+          },
+          {
+            "traceid_byte_count": {
+              "description": "The length in bytes of each request's Trace ID.",
+              "type": "integer",
+              "one_of": [
+                8,
+                16
+              ],
+              "required": true,
+              "default": 16
+            }
+          },
+          {
+            "header_type": {
+              "description": "All HTTP requests going through the plugin are tagged with a tracing HTTP request. This property codifies what kind of tracing header the plugin expects on incoming requests",
+              "type": "string",
+              "one_of": [
+                "preserve",
+                "ignore",
+                "b3",
+                "b3-single",
+                "w3c",
+                "jaeger",
+                "ot",
+                "aws",
+                "datadog",
+                "gcp",
+                "instana"
+              ],
+              "deprecation": {
+                "old_default": "preserve",
+                "removal_in_version": "4.0",
+                "message": "zipkin: config.header_type is deprecated, please use config.propagation options instead"
+              },
+              "required": true,
+              "default": "preserve"
+            }
+          },
+          {
+            "default_header_type": {
+              "description": "Allows specifying the type of header to be added to requests with no pre-existing tracing headers and when `config.header_type` is set to `\"preserve\"`. When `header_type` is set to any other value, `default_header_type` is ignored.",
+              "type": "string",
+              "one_of": [
+                "b3",
+                "b3-single",
+                "w3c",
+                "jaeger",
+                "ot",
+                "aws",
+                "datadog",
+                "gcp",
+                "instana"
+              ],
+              "deprecation": {
+                "old_default": "b3",
+                "removal_in_version": "4.0",
+                "message": "zipkin: config.default_header_type is deprecated, please use config.propagation.default_format instead"
+              },
+              "required": true,
+              "default": "b3"
+            }
+          },
+          {
+            "tags_header": {
+              "description": "The Zipkin plugin will add extra headers to the tags associated with any HTTP requests that come with a header named as configured by this property.",
+              "type": "string",
+              "required": true,
+              "default": "Zipkin-Tags"
+            }
+          },
+          {
+            "static_tags": {
+              "description": "The tags specified on this property will be added to the generated request traces.",
+              "type": "array",
+              "elements": {
+                "fields": [
+                  {
+                    "name": {
+                      "type": "string",
+                      "required": true,
+                      "not_one_of": [
+                        "error",
+                        "http.method",
+                        "http.path",
+                        "http.status_code",
+                        "kong.balancer.state",
+                        "kong.balancer.try",
+                        "kong.consumer",
+                        "kong.credential",
+                        "kong.node.id",
+                        "kong.route",
+                        "kong.service",
+                        "lc",
+                        "peer.hostname"
+                      ]
+                    }
+                  },
+                  {
+                    "value": {
+                      "type": "string",
+                      "required": true
+                    }
+                  }
+                ],
+                "type": "record"
+              }
+            }
+          },
+          {
+            "http_span_name": {
+              "description": "Specify whether to include the HTTP path in the span name.",
+              "type": "string",
+              "one_of": [
+                "method",
+                "method_path"
+              ],
+              "required": true,
+              "default": "method"
+            }
+          },
+          {
+            "connect_timeout": {
+              "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ],
+              "default": 2000
+            }
+          },
+          {
+            "send_timeout": {
+              "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ],
+              "default": 5000
+            }
+          },
+          {
+            "read_timeout": {
+              "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
+              "type": "integer",
+              "between": [
+                0,
+                2147483646
+              ],
+              "default": 5000
+            }
+          },
+          {
+            "http_response_header_for_traceid": {
+              "type": "string"
+            }
+          },
+          {
+            "phase_duration_flavor": {
+              "description": "Specify whether to include the duration of each phase as an annotation or a tag.",
+              "type": "string",
+              "one_of": [
+                "annotations",
+                "tags"
+              ],
+              "required": true,
+              "default": "annotations"
+            }
+          },
+          {
+            "queue": {
+              "type": "record",
+              "fields": [
+                {
+                  "max_batch_size": {
+                    "description": "Maximum number of entries that can be processed at a time.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_coalescing_delay": {
+                    "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.",
+                    "type": "number",
+                    "between": [
+                      0,
+                      3600
+                    ],
+                    "default": 1
+                  }
+                },
+                {
+                  "max_entries": {
+                    "description": "Maximum number of entries that can be waiting on the queue.",
+                    "type": "integer",
+                    "between": [
+                      1,
+                      1000000
+                    ],
+                    "default": 10000
+                  }
+                },
+                {
+                  "max_bytes": {
+                    "description": "Maximum number of bytes that can be waiting on a queue, requires string content.",
+                    "type": "integer"
+                  }
+                },
+                {
+                  "max_retry_time": {
+                    "description": "Time in seconds before the queue gives up calling a failed handler for a batch.",
+                    "type": "number",
+                    "default": 60
+                  }
+                },
+                {
+                  "initial_retry_delay": {
+                    "description": "Time in seconds before the initial retry is made for a failing batch.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 0.01
+                  }
+                },
+                {
+                  "max_retry_delay": {
+                    "description": "Maximum time in seconds between retries, caps exponential backoff.",
+                    "type": "number",
+                    "between": [
+                      0.001,
+                      1000000
+                    ],
+                    "default": 60
+                  }
+                },
+                {
+                  "concurrency_limit": {
+                    "description": "The number of of queue delivery timers. -1 indicates unlimited.",
+                    "type": "integer",
+                    "one_of": [
+                      -1,
+                      1
+                    ],
+                    "default": 1
+                  }
+                }
+              ],
+              "required": true
+            }
+          },
+          {
+            "propagation": {
+              "default": {
+                "default_format": "b3"
+              },
+              "type": "record",
+              "fields": [
+                {
+                  "extract": {
+                    "description": "Header formats used to extract tracing context from incoming requests. If multiple values are specified, the first one found will be used for extraction. If left empty, Kong will not extract any tracing context information from incoming requests and generate a trace with no parent and a new trace ID.",
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "ot",
+                        "datadog",
+                        "aws",
+                        "gcp",
+                        "instana",
+                        "w3c",
+                        "b3",
+                        "jaeger"
+                      ],
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "clear": {
+                    "description": "Header names to clear after context extraction. This allows to extract the context from a certain header and then remove it from the request, useful when extraction and injection are performed on different header formats and the original header should not be sent to the upstream. If left empty, no headers are cleared.",
+                    "type": "array",
+                    "elements": {
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "inject": {
+                    "description": "Header formats used to inject tracing context. The value `preserve` will use the same header format as the incoming request. If multiple values are specified, all of them will be used during injection. If left empty, Kong will not inject any tracing context information in outgoing requests.",
+                    "type": "array",
+                    "elements": {
+                      "one_of": [
+                        "preserve",
+                        "ot",
+                        "datadog",
+                        "aws",
+                        "gcp",
+                        "instana",
+                        "w3c",
+                        "b3",
+                        "b3-single",
+                        "jaeger"
+                      ],
+                      "type": "string"
+                    }
+                  }
+                },
+                {
+                  "default_format": {
+                    "description": "The default header format to use when extractors did not match any format in the incoming headers and `inject` is configured with the value: `preserve`. This can happen when no tracing header was found in the request, or the incoming tracing header formats were not included in `extract`.",
+                    "type": "string",
+                    "one_of": [
+                      "ot",
+                      "datadog",
+                      "aws",
+                      "gcp",
+                      "instana",
+                      "w3c",
+                      "b3",
+                      "b3-single",
+                      "jaeger"
+                    ],
+                    "required": true
+                  }
+                }
+              ],
+              "required": true
+            }
+          }
+        ],
+        "required": true
+      }
+    }
+  ]
+}
\ No newline at end of file