Document Network Security Access Control (host validation and remote reference resolution)

[IsuruGunarathne]

Purpose

Adds documentation for the Network Security Access Control feature (outbound host validation) in WSO2 API Manager, which lets administrators control the external hosts the product is permitted to connect to during API creation, validation, and import flows.

New page: en/docs/administer/network-security-access-control.md.

What it covers

• Overview of outbound host validation and how it is enforced.
• Platform-level (deployment.toml) and tenant-level (tenant-conf.json) configuration, and the precedence between them.
• Host pattern matching, DNS / resolved-IP checks, and private-network blocking.
• Configuration reference and example scenarios for allow / deny modes and empty host lists.
• Enforcement on remote references embedded inside definitions:
  • OpenAPI/Swagger $ref URLs (OAS 2.0, 3.0, and 3.1).
  • Nested WSDL/XSD imports (WSDL 1.1 and 2.0) and SOAP-to-REST type resolution.
  • Backwards-compatibility behavior (enforcement requires a configured policy), the allow-mode www.w3.org requirement for WSDL 2.0, and the redirect limitation.

Related PR / credit

The host-validation baseline (overview, configuration, host matching, and example scenarios) was authored by @JanithaSampathBandara and originally proposed in #11476. That commit is included here under his authorship, and this PR extends it with the remote $ref and WSDL reference-resolution sections.

#11476 currently has merge conflicts. This PR consolidates that work together with the additional sections, so #11476 can be closed in favor of it.

Files

• en/docs/administer/network-security-access-control.md (new page)
• en/docs/administer/admin-overview.md (navigation entry)
• en/mkdocs.yml (navigation entry)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0944621c-d003-4c2b-b17c-2c5ce9f65dfa

📥 Commits

Reviewing files that changed from the base of the PR and between 717cee3 and c8dff3d.

📒 Files selected for processing (1)

• en/docs/administer/network-security-access-control.md

🚧 Files skipped from review as they are similar to previous changes (1)

• en/docs/administer/network-security-access-control.md

---

📝 Walkthrough

Summary

• Added documentation for Network Security Access Control in API creation, validation, and import workflows.
• Documented platform and tenant settings, precedence, host matching, network restrictions, and remote reference handling.
• Updated examples to use server.network_security.access_control.
• Added the page to the administrator documentation navigation.

Walkthrough

Adds a new “Network Security Access Control” administration page. The documentation covers platform and tenant configurations, precedence, hostname matching, DNS resolution, private-network blocking, empty host lists, configuration examples, and enforcement for remote OpenAPI and WSDL references. It also documents WSDL 2.0 and redirect limitations. The page is linked from the administration overview and MkDocs Governance navigation.

Suggested reviewers: chamilaadhi, tharikagithub

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the documentation scope and related PR, but it omits most required template sections, including testing, security, release notes, and migration details.	Add the missing template sections and provide applicable details, or mark them N/A with brief explanations where they do not apply.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the new documentation and its main subject, host validation and remote reference resolution.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}