Kong User Calls, 13 Dec 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Discover the New Plugins in Kong Gateway 3.1

Description

Kong Gateway 3.1 includes several new plugins, forming our most powerful plugin ecosystem yet and with an enhanced functionality for a few existing plugins.

For our last User Call for 2022, Gang Guo (Product Manager, Kong) will deep dive into the following new plugins:

- AppDynamics
- SAML2
- JWE Decryption
- OpenAPI Specification (OAS) validation
- XML Threat Protection

What's more, we introduced an enhancement into:

- Mock plugin
- Forward proxy plugin

A

Hello- everyone good morning, good afternoon, good evening from wherever you're joining us. My name is Dalia and I work as a community manager at Kong, I'm very happy to have all of you join us for the last user. Call for 2022. very happy to have all of you here today um today. The topic will be discover the new con plugins in Kong Gateway 3.1, and we have Gunk who will be presenting.

A

We have also Hans and Sami, who will be doing some demos for you um and please put all of your questions in the Q a function on the bottom and we will answer them at the end of the presentation and yeah with that. I will give it to gun, to introduce himself and to get going with the presentation.

B

Yeah, thank you Dalia um good morning, good afternoon. um This is Gango from London, um so today I'm happy to present to you the new features we delivered in Kong, 3.1 yeah.

B

um The agenda is fairly simple: um I will give everybody a introduction about com, Gateway and also Kong Gateway plugins. um Then we get into the details of new plugins being released in version 3.1. After that we will have two of our Engineers joined me today. To do some live demos of three new plugins at the end we have a short moment for Q a.

B

If we can't address them. We will address them offline Anyway. By the way this session is recorded, so you will get a recording of the session yeah.

B

So very recently, Tong is being being named as a leader by Gardner um the third time, um and we moved even further on the right hand side. So that literally means I'm. A product offerings is much more advanced than any other vendors, um because you can see on the chart. You know under the further you're on right hand, side basically means you're more advanced.

B

um Obviously we are newcomers, so we're not as good as you know. The old mature vendors like RPG or mulesoft, because they have been there for probably more than 10 years now, but we are the fattest ones getting the leader content and we are the leaders. So yes, in a row already, so you always the most popular API Gateway in the planet. Already the next thing I'm going to highlight is we have a comb plugin Hub um I put the links on the top here.

B

If you haven't been visited these sites, I suggest you do um now, with this new plugin being released in version 3.1.

B

This plugin Hub actually has about more than 100 plugins, provided here not only by Chrome, but also by Compounders, and also lots of cone lovers like you, they actually contributed also open source plugins for the community as well um have a look, and you will find something probably helpful for your work.

B

Next one is I'm going to mention is plugging compatibilities. um That's all you know. Chrome Gateway can be deployed in different mode, um and normally you can do um TV lays you know if you open source. Probably this is a easy way to do it. um You don't need a database, you just have a configuration files and load. Your call, um the downside. Obviously, is you can't really change your configurations on the Fly and it will be fixed, as you start call.

B

um The good thing, obviously is you know you can scale it easily and it's very tiny footprint, so I can still see lots of people running dblens. Today, um then, the classic ones, uh which is um every single con Gateway instance, have a database behind it.

B

um The good thing is, everybody can change the configurations and read the latest configurations out. um The bad thing is the database has been connected all the time by all the instance. Then the third mode is hybrid. Constantly you have a safety only being connected to the database and DP nodes are talking to the CP.

B

The good thing about this is: you can still benefit from dynamically changing configurations of the con Gateway and also apply plugins on the Fly um as well as you don't really need to have the DP nodes connected to a database, especially two when your DP nodes is actually running in the DMZ.

B

um So with this three deployment mode, uh Iman um avacon Gateway plugins, obviously has a compatibilities to each of these deployment mode. So if you apply a plugin um and if it does not work as expected, um then I recommend you check this compatibility list. It might be because your deploy mode is not supported by that particular plugin. So that probably will reduce 50 of the chance of you know. You spend lots of time figured out why it does not work. Actually, it's fundamentally not supported by this deployment mod.

B

So the link I put down already there below, um have a look. So why I highlight this too, is because this is um fundamental uh for the plugins so before you can enjoy any vlogging, so any new plugins, this basic knowledge- hopefully will you know serve you for a long way.

B

Then we will have a quick pull uh from Dalia.

A

um Yes, let me raise it see the first one t, let's see I just launched the poll, do you use Chrome, open source, Enterprise or both just curious to see that will help us obviously determine the topics for future user calls and what you're most interested in.

B

Looks like we have more Enterprise customers.

A

Nice I'm happy to see that there is also from both open source um because for the user calls we try to cover both topics. um We have a lot of topics which are only for the open source. Today we do Enterprise, so we will make sure we rotate them.

A

Cool I will leave this open, um so people can vote and you shall we do the other one as well.

B

Yeah carry around yeah.

A

All right just a sec, all right, so here's the other one. What is your deployment model? So let me launch it.

A

That will also be helpful for us to see awesome. Traditional hybrid.

B

Yeah, it looks fairly distributed. Yeah.

A

A

Awesome everyone has answered, let's carry on with the presentation. Thank you all.

B

Yeah, thank you.

B

Comb plugins, um of course,.

B

So obviously um why we provide Chrome plugins is because, um although con Gateway is really lightweight and can be deployed anywhere inside the Dockers inside kubernetes in the cloud on premise, um we would like to get it even more powerful.

B

So comb plugin is the way we actually modeled our comp plugin con gateways to be able to make it extendable um getting more powerful and flexible.

B

So the key is to give user the power and make them to conquer their daily problems or issues uh with the least of effort. um All the plugins we're trying to you know, build them um use. Obviously, um so all the plugins we currently bundled with chrome, um you can actually um use it using commanding uis or you use API calls to apply them or change them.

B

You can also do the deck dump or deck thing to declaratively apply the plugins um and in the past, connect is a little bit lagged behind to support the latest release plugins. Nowadays, we more or less get to a similar time from connect to support the newly released Enterprise plugins. Officially, um the other thing is, you know it gives user the flexibility and power um you probably already realized. You have with limiting Transformations possibility related plugins like log metrics and tracing. We also can Dynamics change the plugin execution orders.

B

Things goes in three and we provided open source, open, Telemetry support and web socket support.

B

um Almost at criticide we already have authentication authorization and also security secret management capabilities.

B

um We have a very powerful oidc plugins, which can support probably more than 20 or 30 idps, and we have very rich planning ecosystem. um If you go to the plugin Hub, you probably can fill that already. um I have listed the new plugins. We have added uh inversion 3.1, um which um give our users even more power. All these green ones that is here are new plugins um samo2 is a new way to authenticate income Gateway. Obviously, some or two probably existed for quite a long time um in all days. If anybody here.

C

B

A soft based web services- you probably know some or two um for quite a long time um and at the beginning, because Kong Gateway is relatively new, so we go with the OS and oidc uh awesome and mainstream, but when we grow our custom basis, especially the big Corporation customers, the CEO would like us to support those mature standards, the next time or two. So as required, we provided summer to support um in this release um and also the XML scrap protection is similar.

B

um Although soft Services is um there for quite a long time, but you will be surprised, there are still lots of XML based web services so um to protect our customers. We also added XML threat production plugin um other than the traditional ones.

B

um We also have added a OAS validation, plugin, which is very new and because nowadays, majority of the apis are restful based. um So you will send link Json and Json request and Json response. um This OS validation, plugin can do is to based on your open API specifications to do the request and response validation against it.

B

um This will be able to not only validate your format and you know any format, errors or requests. uh You know, structure problem but also can reduce um you know the harmful attack. um You know against u8 guys.

B

Then we have this job decryption plugin, um you probably already know we have jobs, validations, jobstana and uh now we're at this job. Decryption is um because we have lots of open banking. Financial customers um they are they are asked to do- is to validate against a encrypted your token, which they are Partners I need.

B

um Obviously we can't really do validations against the encrypted tokens, uh so the first thing we would like to do is to do a decryption, um so this plugin does exactly that, so we will decrypt a encrypted token and after that we can send it to a job validation plugin to do the normal validations.

B

um Last but not least, we.

C

B

Another new plugin being added to support path Dynamics, um if you are a bank or insure or the government or big corporations and academics, probably is the application Performance Management um systems you're. Using um with this plugin, we could send transactions to our Dynamics as part of the API going through. You will be able to see entire API Journeys and, in the aftermath controller from one single place.

B

um We also enhanced existing mocking plugin, which I'm not wrong here. Morgan plugin was provided probably last year, um but it was fairly basic and this time I did more features to make sure we can support much more status code, samples being returned and also you can define a randomized way which status code you let's get written, it will be much more useful than you can see, I'm working, so that's the enhancement. Obviously, um now let me dive into uh install games uh uh provided yeah.

B

Yeah, um the first one is up Dynamics plugin, um so you can see on the left hand, side, we have a blunt API client, it could be a web client or mobile client.

B

um They will do, is a click link or click a button. You know in your mobile apps or web apps and then API call being made through API gateway.com um and then homework proxy. The API request to a back-end, microservices or apis implemented, um and the update agent being normally installed on the web front end and also on the back and macro Services, which can send the API transactions informations to the academics before Chrome API before come of the plugins.

B

Con Gateway is more like a black box and with this plugin now in place, um customer can actually see it from intern, from the clip being made on the web front, end to clone proxy the apis through and then the backend service. You get the request and send the response back. You can track it end to end and preferably um action if and in performance bottleneck or if any errors from one single place in the aftermax controller outbox.

B

This is uh very intuitive to use and I think later on, abandonia will demo it in life.

B

If you switched on configured properly, um it actually um get all this flow map drawn for you automatically um in your update controller. This is one of the samples from our using customers and then the second one is summer. Two I have mentioned earlier: um Samuel 2 is a fairly mature standard.

B

um We haven't supported it because you know um we're mainly focused on job token and oidc, um and now, with this new plugin, um you could do single sign-on uh with lenders like after directory from Microsoft.

B

The process is very simple when you also make the API call, if you have this plugin enabled um user will be redirected to Microsoft active directory to do the login using the Microsoft credentials.

B

If they logging are successful, um a token will be issued and the comb will validate that token to make sure this is the user, and this is this authenticated um by interpret um those versions in the token itself, and then, after that, one passed. Kong will pass on the request to the backend services and also uh convo store the sessions um in a cookie. So when you make the next call, Como use the ignition session cookies to make the API boxing, so you don't really need to do is to authenticate every single time.

B

um This is particularly useful if you like to still do a Samo based single cell for your API consumers.

B

um Next one um we also are going to demo. It today um is the open, APS decision, validation, plugin. um We already have a using plugin, which called request validation, um but that one is only be able to do requests.

B

This plugin can do both request and response against your open, api's decisions, um not only that this one also supports you to um configure a web cook endpoint. So if anything not pass your validations and you can actually send that request and response body to that web hook uh for the um debugging or root code analysis later. So um our engineer will demo today.

B

um I think I mentioned this one as well. The decryption plugins. um This one is to decrypt a token.

C

B

Before we can do a job token validation, the encryption and decryption keys can be exchanged using our jks and font. um We have enhanced and standardized jks and important with this plugin um behancing. So um actually we are planning to um standardize all this jks key and the plant across the Johnson and the YDC plugin in the future releases from functionality perspective forget about the underlying changes we are doing on the jks or JWT. You know, libraries, the functionality is straightforward, you get encrypted token coming in and then this one will decrypt it.

B

So you can actually use it um like normal with a dropped, validation, plugin.

A

B

If it's a normal plugin, so um it's really suits forward nice and special next one is XML Strat production.

B

um This one is um thanks to you know a new library is being imported at this time with zip on one um own us, everybody know it's based on Lua, um so um obviously Lua is not um as rich as any other language like Java, so um we haven't done small for quite a long time is because you know libraries to support xmo from luo is fairly limited.

B

um Now, this time we can do the XML threat protection plugin. um It's all thanks to another XML library is being quoted into Kong, which is save-based. Obviously, and so law can call those libraries to do as pause or check the structures check the dams.

B

um So you can limit the feed, apps and limited structures and the payload size. So we could do lots of preventions for you um against the bad guys. Obviously um so have a look to the documentation and play with it. um It is quite powerful. Obviously, um next one I think I mentioned earlier as well. uh The more game planning um this plugin.

B

We used to be able to only support for everyone or two sets codes, samples being returned like to 200 or 201 no match useful, but with this enhancement we can now support more or less all. This stats is called being returned with examples, and you can even Define um by which examples of Cisco you would like to be returned by this plugin and as well as we can simulate some latencies on your mock, Services, say: yeah I would like to have 500 milliseconds latences being simulated by Denmark.

B

You can also Define it now in a small plugin. So again, you know very useful plugin to have, especially if you don't have the real API being implemented, but you still would like to test it or or share with your developers.

B

So um again you know welcome you to play it, and if you have any further suggestions for improvement, you know, let us know uh I think I talked about plugins by Lots, because different one literally is a plugin which release um immediately after the version three we announced The Summit in September, um but also you know, we have some improvement income manager as well.

B

If you remember, we probably released consumer groups uh for quite a long time ago, um but consumer growth, as well as only supported by Dak and element API. um Nowadays, you can actually using Code manager graphically um great or sun consumers into a consumer. Growth now um have.

D

B

Know it's much easier than before now, um and also this common manager version 3.1 is supporting uh secret management and really show your certificate details um in the code manager, um as well as some more tool tips being provided for the plugin configurations.

B

If you score your mouse through those configurations, icons like question marks or something they will give you more hands and more suggestions about plugin configurations.

B

um That's common manager version simple one: um I think that is very high level of new features and new plugins. We released um being version 3.1 um I. Think you probably seen after about slides and heard about enough series uh now I think it's a good time to do the live demos, so you can see it in action um by yourself.

B

um I will stop sharing and pass on to uh one of my Engineers um Samuel to start a demo of the OS validation, plugins Samuel.

C

Yeah all right, let's say your screen now. Thank you again. Just give me one second to share my screen.

C

Okay, uh so hello, everyone, my name, is Samuel I am a software engineer, income and today we're going to see some of the features of this new plugin OES validation. So this plugin, as gang anticipated, is meant to validate requests and responses based on an API specification that you can provide in the configuration of the plugin.

C

So this is a very basic example of how to configure the plugin as usual, you need to pass the plugin name and then the only required parameter here is, of course, the API specification.

C

This is accepted as a Json or a yaml file, and it supports both the oas2 or oas3 formats.

C

There are a lot of parameters here, but I want to focus on some of these I think the most interesting that we're going to see in this demo are the ones that begin with, validate and then underscore.

C

Basically, the function of these parameters is to enable or disable modularly, some of the validation features of the of the plugin itself. So you can, for example, configure a certain specification and then turn on and off all the different validations of URI params, header, query or body.

C

So let's see this in action now, as I said a while ago, this is a very basic configuration of the plugin I'm passing the name in this example I'm using the pet store specification um which I'm passing as the API is back parameter and then I'm setting this verbose response to true. This basically allows to see the reason for the failed validations right in the response body, so this is useful for debugging purposes.

C

So, if I configure this plugin, you can see that basically, all of the validation properties are set to True by default and yeah. So this is basically the the plugin being set up. Let me just patch the plugin ID to use later and we're going to see now uh what a valid request looks like so, of course, I'm passing now a valid body um to the path endpoint, like I, said we're using the Swagger Path store, so I'm, sending a post request to the bat, endpoint and I'm going to pass a valid body.

C

Now, just to see that it returns a 200, okay and I'm doing the same with a get request by just fetching uh the um pets that we just posted. So we get we that are, we get our gorilla back with the same ID, so um we are going to now try to see um what happens when the validation fails, so we're going to use the same endpoint path123 that, as we saw a while ago, it expects a path ID to be passed as a required integer parameter here in the path so If.

C

Instead of passing a valid integer, I I, it was any string, for example. This should fail the validation and, in fact, as you can see, I hope you can read it in the message here. We see a description of this failure, so this validation failed because the type is wrong. It expected an integer and it got a string, but, as we saw a while ago, what we can do, for example, with this plugin, is to configure um all of these different properties to change the way the validation works. So, for example, this last request failed.

C

Its validation because you arrived parameter was incorrect. So, for example, if we patch the plugin- and we set this to false- to avoid doing this kind of check- I need, of course, to set the right plugin ID.

C

And now we have uh the plugin configured without the URI parameter, as you can see here, validation.

C

So if we try the same request again, we see a different response, because this time the response is coming from the upstream- and this is basically the Java back-end complaining, because some string cannot be converted to a long in this case.

C

So, let's see something similar. uh This is a valid request where we are passing, as we saw a while ago, a valid body, but in our specification here the pet that we're passing in the body has the name as a required parameter. So now we have the body validation enabled. So if we remove the name from here, we would expect this to fail and in fact we got a for rendered by the request, which explains that the property name is required.

C

We can do something similar to what we just did uh disable the request body validation in the same plugin, and the same request is going to pass because this time we don't basically do the the body validation. So this is going to to the upstream and returning a 200 okay response um yeah. This is basically uh all of the main functionalities I wanted to show in this demo.

C

For this plugin uh asgan said a while ago, it's also possible to configure all of the validation uh to report a Web book with um the validation result and yeah. That's pretty much it. Thank you.

B

Yeah, thank you. Sami um I think uh now it's probably hand stamp to demo the update and summer to plugin.

B

D

B

D

I'm ready to share my screen.

D

So, let's start with the cell plugin. So um thank you again. My name is Hans I'm, a software engineer with the home Gateway team um and I'm going to talk about the seml plugin, which is a plugin that is used to um authenticate web applications that are deployed behind com web applications means it always requires a browser to be present so that users can go through the um IDP login flow.

D

So the basic interaction is the user with the browser goes to con Gateway con Gateway realizes that there is no session redirects, the user to the IDP.

D

um The user goes through the IDP login flow, and once that is completed, they are sent back to the gateway gateway, evaluates the authentication result and then sends the request to the web application server. So it's important to understand that that channel is really only useful for uh web applications that have a browser attached to the user or by the user. It gives us a browser.

D

um Currently we we support um Microsoft Azure active directory, but in general the plugin can work with any saml 2 provider and we will be adding more providers over time as the need arises.

D

um The configuration is like um standard configuration um where you have to specify the individual parameters of the sample provider uh in the config that you are sending to Kong the required parameters for sorry for the quick scrolling for um Azure. Active directory are documented on our page, so it is relatively straightforward following this, uh um how to style documentation to get set up with um um with a seml and Azure active directory.

D

um So, basically, what you do is you create um the plugin um we we have. We I've been attaching it to what I call the central service here and it's protecting the symbol path.

D

uh I have elided the uh certificate and encryption key data and that you have to send when, when setting up the service, so how this looks like in practice is um when I go to my con installation um to the protected resource and realize I have no session and sends me to the uh to Azure active directory, and here I have to choose my account.

D

We are using a another IDP which we Federate with, but now I have created a session in Azure, active directory and and Azure is now going to send me back to my application, and this is the response from the application. That is that we have configured here in in the service.

D

So now what we have here is, of course, a session, um and this session is independent of the sample session that that we have, with the provider it's possible to uh authenticate every request. So, if I remove my session here and reload, um the thing then I don't need to get through the whole um login dense, because sorry error already has a session for me and they just re-establish it with com foreign.

D

This is the assemble plugin. Now, let's go to epdynamics.

D

uh For those of you who don't know at Dynamics is a an application, um Performance Management platform, so different parts of the of an application that is using um different servers, front and back-end. uh Send information to app Dynamics and app dynamics. Consolidates that into a common picture of requests that are flowing so the com plugin for app Dynamics, contributes to that to that mechanism and sends information about requests that are going through Kong in the context of a a business transaction that is modeled in app Dynamics.

D

um The configuration of the plur of the app Dynamics plugin is global because we are using um the the CC plus SDK, which is also mentioned here. The CC plus SDK, delivered by Dynamics, is a component that we load into the worker process and that manages the communication between um the power application and the the app Dynamics controller.

D

um This makes the installation of the plug-in a bit more involved because uh for one we cannot um deliver the agent uh SDK with uh com. You need to download it from the Dynamics site and then the other, like circumstance, is that configuration of the plugin is going through environment variables. So um the the um the Kong environment needs to be changed in order to hook up the app Dynamics um account with the agent.

D

This means that that, in effect, when configuring, the plugin, uh it just needs to be enabled there are no parameters in the dynamic configuration that we have in Kong. Everything is going through the common environment variables um and what I'm going to do to demo. This is I'll just run um a script that sends a couple of requests to this configured um instance of Kong, and then we are going to look at the epidemics UI to see the requests that have been flowing.

D

This 409 is because the plugin was already initialized, so um one important aspect is to know is that the SDK is buffering the messages that we are sending. So even though we are sending requests through through com now, and they are also already scheduled to be sent to app Dynamics in the app Dynamics UI. If I look here, uh we are not going to see them.

D

We go to 15 minutes, so nothing is shown on the scorecard yet because um the messages are still buffered in um in the SDK, but I'm going to go a bit back further a bit. So so we see some of the transactions that have been sending earlier on. So what we do when sending business transactions to app Dynamics is we we normally just send business transactions and only if we detect an error state from the Upstream server like a non-positive non-2 x, x, response.

D

We uh report that as an error, so, for example, I have one error here. That is a um 404 error. Let me see does not exist sorry, so we, the the app stream server, has returned a 404 and now in in app Dynamics, we can see this 404 error and then we also um monitor execution or well uh response time of the Upstream server. So if the Upstream server is responding very slowly like in the minutes, then we report that also.

D

um This is basically what I can show for this plugin. Thank you.

B

Yeah sense has um so I think we back to the Q a session. um Let me read out to the questions. Currently we got in the Q. A um the first question is from Jim. um What is the Gateway overhead uh scale and performance with the OS stack, validation, plugin um Jim? To be honest, uh I don't have the latest figures about the latency I did or memory used whatsoever, um but based on man standing.

B

um This is a native Lua plugin um they haven't got much uh overhead or um I did too much latency, but.

D

B

um We probably will test it out and get some feelings. However, this is purely based on how big you just in payload is and how complex it is. So I can only say it's, probably as normal or fairly low, um but I.

C

Can't really give.

B

You enough feedback. um The second one is: um there's a mock plugin, it's also from Jim. um Does the mob plugin return Dynamic response based on the requested body, um this one I, don't think so, because in the mock plugin we do not implement they the API logically, so the request shouldn't make any difference, um especially request. Payloads didn't make any difference to the response examples to returned.

B

um The key is actually the Past coming in to this API Mock and also the headers. um Let me share my screen. Probably that will make more sense.

B

So if I share my screen, let me share my screen.

B

Yeah, if you can see my screen here, um we actually do is we're actually sending a header say: x-con mock status code header. So when we ping a endpoint of the API at the same time, we will give you a parameters in the header. Say: yeah return me the 500 examples.

B

Then they actually return the examples you write in your definitions, the whole thing you have specs and simile. um We can actually give you an example uh ID, for example. Here you, you can have two values um to return either power or Sasha, but you can actually Define this in a header, so the particular example will be returned, so I think it's based on two things. One thing is the header value you're sending the other thing is obviously the URL use, email plugin. So the request body is not um the determined Factor.

B

So hopefully that address your questions in.

B

Yeah the summer one uh from John Williams. um Why are we pass it through? The conga um in the examples you list about here? uh Is a user already being authenticated and they're having a summer token either.

B

So if that user is going to make an API call to com, obviously con need to be able to do is to open up that summer token and be able to interpret it to say yeah whether this user is actually the user they claim to be, or actually this token is issued by the idps on its first point fasting, so I think even the scenarios you imagine here um will actually need someone to token to be in place.

B

Otherwise con will not understand um your summer token and the Hans demo thing is the um SP initiated similar to authentication flow so which it literally means cone will be the first hit point uh and that time customer hasn't got a Sumo token. uh In the request header, then custom will be directly back on to do the authentication. What you mentioned is actually um the IDP initiated, um authentication flow, so those needs some of the tokens be in place.

B

uh Falcon to be able to interpret and validate this summer to token is indeed a valid token and the user is a value user to be authenticated so for both I think can't need this plugin to be able to understand someone to talk. um Hopefully that address your question John uh next one is the update. What kind of performance impact can we expect that's from action?

B

um Can we expect, if unable for large numbers in the root, um I think for the app Dynamics plugin that performs the impact um is fairly minimal?

B

The reason for that is because um we're actually using the native C plus plus SDK, provided by update so cone plugin, is actually talking to the update native C plus SDK agent, and the agent is not going to Simply understand the informations to the controller, but they will buff it up and you can actually config an interval say how often the SDK is going to stand those informations to controller so from cone to that SDK locally is asynchronous um and more or less like stately sync underscore, um but when this SDK is summed up the transactions, they actually send it constantly in batch.

B

So so, with this architecture in place, the performance is, you know nearly now impact um we're actually tested with a very big Bank. um It's probably added about you know sometimes seven milliseconds or 20 milliseconds or 40 milliseconds.

B

So it's it's minimal impact.

B

Next one is from shashanks uh if I pronounce your name. You know sorry about that. um If the response validation is turned on in OAS, validation planning, what HTTP status code and error message is returned by com. In case of error, this one I think.

C

Before it's 406 not acceptable, I just finished testing a second ago, so yeah.

B

Okay, that's going.

C

To answer yeah.

B

Okay, thank you much yeah I'm about to take it away. I think yeah.

A

I, don't really.

B

Know to be honest, um okay, next question: uh oh yeah, we don't have any open questions. I guess we answer all of them.

A

Yep I, just I, think one of our participants wants to ask a question. So I just permitted Zhao to ask a question so Xiao please go ahead. uh You should be able to talk now.

A

You can unmute yourself and and ask.

A

Nope, okay, Joe.

B

You're you're, still muted I think.

A

B

Can't hear you.

A

uh Sorry I, it was by mistake: okay, no, no.

C

Words no worries, sorry.

D

A

No worries cool, well, I, think that was all of the questions. um Thank you so much gank Sam. Hence you guys were awesome. Thank you very much. That was our last user call for 2022 and yeah I want to wish all of you the great great rest of the Year. Merry Christmas happy New Year, if you're celebrating- and uh we hope to see you in 2023 for all of our next events, bye.