JSON Threat Protection Policy | MuleSoft Documentation
# JSON Threat Protection Policy
**Policy Name** | JSON Threat Protection  
---|---  
Protects against malicious JSON in API requests  
Security  
**First Flex Gateway version available**  
**Returned Status Codes** | 400 - Bad Request  
## Summary
Applications processing JSON requests are susceptible to attacks characterized by unusual inflation of elements and nesting levels. Attackers use recursive techniques to consume memory resources. Dramatic swings in the size of the application data often signal a security problem. The JSON Threat Protection policy helps protect your applications from such intrusions.
If you find that attacks on your Anypoint Platform setup are difficult to detect, design your services architecture with layers of protection in addition to JSON Threat Protection.
## Configuring Policy Parameters
### Flex Gateway Local Mode
In Local Mode, you apply the policy to your API via declarative configuration files. Refer to the following policy definition and table of parameters:
```
- policyRef:
  name: json-threat-protection-flex
 config:
  maxContainerDepth: <int> // OPTIONAL
  maxObjectEntryCount: <int> // OPTIONAL
  maxObjectEntryNameLength: <int> // OPTIONAL
  maxArrayElementCount: <int> // OPTIONAL
  maxStringValueLength: <int> // OPTIONAL
```

Parameter | Required or Optional | Default Value | Description  
---|---|---|---  
`maxContainerDepth` |  Specifies the maximum nested depth. JSON allows you to nest the containers (object and array) in any order to any depth. Specifying -1 indicates that the field value has no limits.  
`maxObjectEntryCount` |  Specifies the maximum number of entries in an object. Specifying -1 indicates that the field value has no limits.  
`maxObjectEntryNameLength` |  Specifies the maximum string length of an object’s entry name. Specifying -1 indicates that the field value has no limits.  
`maxArrayElementCount` |  Specifies the maximum number of elements in an array. Specifying -1 indicates that the field value has no limits.  
`maxStringValueLength` |  Specifies the maximum string value length. Specifying -1 indicates that the field value has no limits.  
#### Resource Configuration Example
```
- policyRef:
  name: json-threat-protection-flex
 config:
  maxContainerDepth: 10
  maxObjectEntryCount: 10000
  maxObjectEntryNameLength: 80
  maxArrayElementCount: 10000
  maxStringValueLength: 255
```

### Managed Flex Gateway and Flex Gateway Connected Mode
When you apply the policy to your API instance from the UI, the following parameters are displayed:
**Description**  
---  
Maximum Container Depth | Specifies the maximum nested depth. JSON allows you to nest the containers (object and array) in any order to any depth  
Maximum String Value Length | Specifies the maximum length of a string value  
Maximum Object Entry Name Length | Specifies the maximum string length of an object’s entry name  
Maximum Object Entry Count | Specifies the maximum number of entries in an object  
Maximum Array Element Count | Specifies the maximum number of elements in an array  
A value of -1 indicates that the field value has no limits.  
---  
## Payload Example
If your payload contains the following example JSON:
```
{
  "Players":[
   {
     "Name":"Sachin",
     "Email":"sachin.tendulkar@example.com"
   },
   {
     "Name":"Suryakumar",
     "email":"Surya@example.com"
   },
   {  "Name":"Bhuvi",
     "email":"bhuvi@example.com"
   },
   {
     "Name":"Jonty",
     "Email":"jonty@example.com"
   }
  ]
}
```

The policy defines the example parameter values as follows:
Parameter | Value | Explanation  
---|---|---  
Maximum Container Depth | The depth of the `Name` and `Email` entries  
Maximum String Value Length | The length of `sachin.tendulkar@example.com`  
Maximum Object Entry Name Length | The length of the `Players` object entry name  
Maximum Object Entry Count | The number of entries in each `Players` object  
Maximum Array Element Count | The number of elements in the `Players` array