From b2b264a5441731bb7e11ae1bbbae4d2ee1015b5c Mon Sep 17 00:00:00 2001
From: Sam Gunaratne <sam.gunaratne@broadcom.com>
Date: Fri, 11 Sep 2026 14:33:57 -0600
Subject: [PATCH] Add route_policies to openapi spec

---
 .../requestBodies/DomainCreateRequestBody.yaml         | 10 ++++++++++
 .../apis/cf/latest/components/schemas/Domain.yaml      | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/docs/openapi/apis/cf/latest/components/requestBodies/DomainCreateRequestBody.yaml b/docs/openapi/apis/cf/latest/components/requestBodies/DomainCreateRequestBody.yaml
index 12b0e53d79f..48a3b3f02fa 100644
--- a/docs/openapi/apis/cf/latest/components/requestBodies/DomainCreateRequestBody.yaml
+++ b/docs/openapi/apis/cf/latest/components/requestBodies/DomainCreateRequestBody.yaml
@@ -20,6 +20,16 @@ content:
               type: string
               format: uuid
           description: 'The desired router group guid.  _note: creates a `tcp` domain; cannot be used when `internal` is set to `true` or domain is scoped to an org_'
+        enforce_route_policies:
+          type: boolean
+          description: When `true`, GoRouter enforces route policies for routes on this domain using mutual TLS (mTLS). Set at creation only; cannot be changed on update. Cannot be used with internal domains or router groups.
+        route_policies_scope:
+          type: string
+          enum:
+            - any
+            - org
+            - space
+          description: 'Operator-defined boundary for allowed callers: `any`, `org`, or `space`. Required when `enforce_route_policies` is `true`. Set at creation only; cannot be changed on update.'
         relationships:
           type: object
           properties:
diff --git a/docs/openapi/apis/cf/latest/components/schemas/Domain.yaml b/docs/openapi/apis/cf/latest/components/schemas/Domain.yaml
index 520314e54e4..798a70f6c1a 100644
--- a/docs/openapi/apis/cf/latest/components/schemas/Domain.yaml
+++ b/docs/openapi/apis/cf/latest/components/schemas/Domain.yaml
@@ -25,6 +25,16 @@ allOf:
             - http
             - tcp
         description: Available protocols for routes using the domain, currently `http` and `tcp`
+      enforce_route_policies:
+        type: boolean
+        description: When `true`, GoRouter enforces route policies for routes on this domain. This field only appears in the response when set to `true`. Set at creation only; cannot be changed on update
+      route_policies_scope:
+        type: string
+        enum:
+          - any
+          - org
+          - space
+        description: 'Operator-defined boundary for allowed callers: `any`, `org`, or `space`. Required when `enforce_route_policies` is `true`. This field only appears when `enforce_route_policies` is `true`. Set at creation only; cannot be changed on update'
       relationships:
         $ref: './Relationships.yaml'
       metadata: