anchor.diff:  + size: 1000 (number) - Total number of objects in collection.
   + has_more: false (boolean) - Is this collection have more data to load in the same style as last request loaded it.
   
  -## API
  +## General
  +### `HTTP_Verb` (enum)
  +- POST (string)
  +- PUT (string)
  +- GET (string)
  +- DELETE (string)
  +
  +## APIs
  +### `API__Request`
   + name: my_api (string) - Unique name for API.
   + request (object, fixed-type) - Request description.
  -    + methods (array[enum], required) - HTTP request method.
  -        + POST
  -        + PUT
  -        + GET
  -        + DELETE
  +    + methods (array[`HTTP_Verb`], required) - HTTP request method.
       + scheme: http (string) - HTTP request scheme. May be: `http`, `https`.
       + host: `os-dev-gateway.nebo15.com` (string) - DNS address of your API or its IP.
       + port: 80 (number) - Port on which your API recieves requests.
  -    + path: /andrew/ (string, required) - Public path to your API.
  -
  -## `API_Full`
  +    + path: /andrew/ (string, required) - Public path to your API. Must start with `/`.
  +
  +### `API__Response`
   + id: 56c31536a60ad644060041af (string) - Unique ID for API.
  -+ Include API
  -
  -## Plugin
  ++ Include API__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
  +## Plugins
  +### Plugin
   + name: myplugin (string) - Plugin name
   + is_enabled: true (boolean) - Flag that shows that plagin is enabled or disabled.
   + settings (object, fixed-type) - Object that describes API plugin settings.
     + key: value - A key-value storage for your API plugins.
   
  +### `Plugin_Response`
  ++ Include Plugin
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
   ## Proxy Plugin
  -### `Plugin_Proxy`
  +### `Plugin_Proxy__Request`
  ++ name: proxy (string, required)
   + is_enabled: true (boolean, required)
   + settings (Plugin_Proxy__Settings, fixed-type)
   
  +### `Plugin_Proxy__Response`
  ++ Include Plugin_Proxy__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
   ### `Plugin_Proxy__Settings`
  -+ Include Plugin_Proxy__Settings__Upstream
  ++ upstream (`Plugin_Proxy__Settings_Upstream`, required)
   + `strip_host`: false (boolean, optional) - Keep HTTP HOST host header when proxying request to an upstream.
   + `strip_api_path`: false (boolean, optional) - Strip API part of path when sending request to upstream.
  -+ `additional_headers` (object, optional)
  ++ `additional_headers` (array[object], optional) - Additional headers that should be sent to upstream.
       + `X-Consumer-Header`: `header_value`
  -
  -### `Plugin_Proxy__Settings__Upstream`
  ++ `stripped_headers` (array[string], optional) - Headers that should NOT be sent to upstream.
  +    + `x-Unwanted-Header`
  +
  +### `Plugin_Proxy__Settings_Upstream`
   + scheme: https (string) - HTTP request scheme. May be: `http`, `https`, `amqp`, `ws`.
   + host: binlist.net (string) - DNS address of your upstream or its IP.
   + port: 443 (number) - Port on which your upstream recieves requests.
   + path: /json/545708 (string) - Path to your upstream API. You can omit this parameter to preserve path from original request.
   
   ## JWT Plugin
  -### `Plugin_JWT`
  +### `Plugin_JWT__Request`
  ++ name: jwt (string, required)
   + is_enabled: true (boolean)
   + settings (Plugin_JWT__Settings, fixed-type)
   
  +### `Plugin_JWT__Response`
  ++ Include Plugin_JWT__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
   ### `Plugin_JWT__Settings`
  -+ signature: c3VwZXJfY29vbEhhY2tlcgo= (string, required) - Base64 encoded secret to decode JWT token.
  ++ secret: c3VwZXJfY29vbEhhY2tlcgo= (string, required) - Base64 encoded secret to decode JWT token.
  ++ algorythm (enum) - Algorithm that is used to generate signature.
  +    - ES256 (string)
  +    - ES384 (string)
  +    - ES512 (string)
  +    - HS256 (string)
  +    - HS384 (string)
  +    - HS512 (string)
  +    - PS256 (string)
  +    - PS384 (string)
  +    - PS512 (string)
  +    - RS256 (string)
  +    - RS384 (string)
  +    - RS512 (string)
  +    - Ed25519 (string)
  +    - Ed25519ph (string)
  +    - Ed448ph (string)
  +    - Ed448 (string)
   
   ## ACL Plugin
  -### `Plugin_ACL`
  +### `Plugin_ACL__Request`
  ++ name: acl (string, required)
   + is_enabled: true (boolean)
   + settings (Plugin_ACL__Settings, fixed-type)
   
  +### `Plugin_ACL__Response`
  ++ Include Plugin_ACL__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
   ### `Plugin_ACL__Settings`
  -+ rules (array[Plugin_ACL__Settings__Rule], fixed-type) - signature to decode JWT token.
  -
  -### `Plugin_ACL__Settings__Rule`
  -+ methods (array[enum], required)
  -    + POST
  -    + PUT
  -    + GET
  -    + DELETE
  ++ rules (array[`Plugin_ACL__Settings_Rule`], fixed-type) - signature to decode JWT token.
  +
  +### `Plugin_ACL__Settings_Rule`
  ++ methods (array[`HTTP_Verb`], required)
   + path: ^my_resource/ (string, required) - Regular expression on path. **Warning!** It's relative to API path.
  -+ scopes (array[string], required) - Scope can be any string.
  -    + request_api
  -    + read_profile
  ++ scope: `request_api profile:read` (string, required) - Requied scope to request API, delimited by space.
   
   ## Scopes Plugin
  -### `Plugin_Scopes`
  +### `Plugin_Scopes__Request`
  ++ name: scopes (string, required)
   + is_enabled: true (boolean)
   + settings (Plugin_Scopes__Settings, fixed-type)
   
  +### `Plugin_Scopes__Response`
  ++ Include Plugin_Scopes__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
   ### `Plugin_Scopes__Settings`
  -+ strategy (enum, required) - Strategy on which Annon should resolve user ID to scopes.
  -    + pcm
  -    + jwt
  ++ strategy (`Plugin_Scopes__Settings__Strategies`, required) - Strategy on which Annon should resolve user ID to scopes.
   + `url_template`: `http://ec2-52-58-60-8.eu-central-1.compute.amazonaws.com:8081/0/api.svc/party/{party_id}/scopes` (string) - Inside `url_template` you can use `{party_id}` to substitle consumer ID in a request path.
   
  +### `Plugin_Scopes__Settings__Strategies` (enum)
  +– pcm (string)
  +- jwt (string)
  +
   ## Validator Plugin
  -### `Plugin_Validator`
  +### `Plugin_Validator__Request`
  ++ name: validator (string, required)
   + is_enabled: true (boolean, required)
   + settings (Plugin_Validator__Settings, fixed-type)
   
  +### `Plugin_Validator__Response`
  ++ Include Plugin_Validator__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
   ### `Plugin_Validator__Settings`
  -+ rules (array[Plugin_Validator__Settings__Rule], fixed-type) - signature to decode JWT token.
  -
  -### `Plugin_Validator__Settings__Rule`
  ++ rules (array[`Plugin_Validator__Settings_Rule`], fixed-type)
  +
  +### `Plugin_Validator__Settings_Rule`
   + methods (array[enum], required)
  -    + POST
  -    + PUT
  -    + PATCH
  +    - POST (string)
  +    - PUT (string)
  +    - PATCH (string)
   + path: `^my_resource/` (string, required) - Regular expression on path. **Warning!** It's relative to API path.
  -+ schema: {} (string, required) - [JSON Schema](http://json-schema.org/) for validating request body.
  ++ schema: `{}` (string, required) - [JSON Schema](http://json-schema.org/) for validating request body.
   
   ## Idempotency Plugin
  -### `Plugin_Idempotency`
  +### `Plugin_Idempotency__Request`
  ++ name: idempotency (string, required)
   + is_enabled: true (boolean, required)
  -+ settings (object, required) - Settings is reserved for future use.
  ++ settings (`Plugin_Idempotency__Settings`, required)
  +
  +### `Plugin_Idempotency__Response`
  ++ Include Plugin_Idempotency__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
  +### `Plugin_Idempotency__Settings`
  ++ key_ttl: 600 (number, required) - Time to live for idempotency keys. If set to `0` keys will never expire.
   
   ## IP Restrictions Plugin
  -### `Plugin_IPRestriction`
  -+ is_enabled: true (boolean)
  -+ settings (Plugin_IPRestriction__Settings, fixed-type)
  -
  -### `Plugin_IPRestriction__Settings`
  -+ whitelist (array[string], fixed-type, optional) - list of matching IP addresses to whitelist them.
  -    + 255.255.255.1
  -    + 127.0.0.*
  -+ blacklist (array[string], fixed-type, optional) - list of matching IP addresses to blacklist them.
  -    + 255.255.255.1
  -    + 127.0.0.*
  +### `Plugin_IP_Restriction__Request`
  ++ name: ip_restriction (string, required)
  ++ is_enabled: true (boolean, required)
  ++ settings (`Plugin_IP_Restriction__Settings`, fixed-type)
  +
  +### `Plugin_IP_Restriction__Response`
  ++ Include Plugin_IP_Restriction__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
  +### `Plugin_IP_Restriction__Settings`
  ++ whitelist (array[string], fixed-type, optional) - Whitelist of IP addresses or their ranges.
  +    + 255.255.255.1 (string)
  +    + 127.0.0.* (string)
  ++ blacklist (array[string], fixed-type, optional) - Blacklist of IP addresses or their ranges.
  +    + 255.255.255.1 (string)
  +    + 127.0.0.* (string)
  +
  +## User Agent Restriction Plugin
  +### `Plugin_UA_Restriction__Request`
  ++ name: ua_restriction (string, required)
  ++ is_enabled: true (boolean, required)
  ++ settings (`Plugin_UA_Restriction__Settings`, fixed-type)
  +
  +### `Plugin_UA_Restriction__Response`
  ++ Include Plugin_UA_Restriction__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
  +### `Plugin_UA_Restriction__Settings`
  ++ whitelist (array[string], fixed-type, optional) - Whitelist of User Agents or patterns.
  +    + `Chrome*` (string)
  +    + `Mozilla Firefox` (string)
  ++ blacklist (array[string], fixed-type, optional) - Blacklist of User Agents or patterns.
  +    + `Google*` (string)
  +    + `MyBot (version 1.0)` (string)
  +
  +## CORS Plugin
  +### `Plugin_CORS__Request`
  ++ name: cors (string, required)
  ++ is_enabled: true (boolean, required)
  ++ settings (`Plugin_CORS__Settings`, required)
  +
  +### `Plugin_CORS__Response`
  ++ Include Plugin_CORS__Request
  ++ created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  ++ updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  +
  +### `Plugin_CORS__Settings`
  ++ One of
  +    + origin: `*` (string, optional) - Allow all origins
  +    + origin: `https?.*example\d?\.com$` (string, required) - Regular expression to whitelist request origins.
  +    + origin (array[string], required) - List of allowed [request origins](https://www.w3.org/TR/cors/#access-control-allow-origin-response-header).
  +        - http://example1.com (string)
  +        - http://example2.com (string)
  ++ credentials: true (boolean, optional) - Indicates whether or not the actual request can be made using credentials. Credentials are cookies, authorization headers or TLS client certificates.
  ++ max_age: 1728000 (number, optional) - Indicates how long the results of a preflight request (that is the information contained in the `Access-Control-Allow-Methods` and `Access-Control-Allow-Headers` headers) can be cached.
  ++ headers (array[string], optional) - Whitelist of allowed request headers.
  +    - `Authorization` (string)
  +    - `Content-Type` (string)
  +    - `Accept` (string)
  +    - `Origin` (string)
  +    - `User-Agent` (string)
  +    - `DNT` (string)
  +    - `Cache-Control` (string)
  +    - `X-Mx-ReqToken` (string)
  +    - `Keep-Alive` (string)
  +    - `X-Requested-With` (string)
  +    - `If-Modified-Since` (string)
  +    - `X-CSRF-Token` (string)
  ++ expose (array[string], optional) - Indicates which headers can be exposed as part of the response by listing their names.
  ++ methods (array[string], optional) - List of allowed HTTP verbs.
  +    - GET (string)
  +    - POST (string)
  +    - PUT (string)
  +    - PATCH (string)
  +    - DELETE (string)
  +    - OPTIONS (string)
   
   ## Requests
   ### Request
  -+ id: tl8nd5019bkendi1uadl2nqq38g69dbf (string) - unique request identifier.
  -+ idempotency_key: myidempotencykey (string) - Idempotency Key if consumer sent it, `null` otherwise.
  -+ inserted_at: 2016-11-04T16:16:20.875777 (string)
  -+ api (API_Full, optional)
  ++ id: `tl8nd5019bkendi1uadl2nqq38g69dbf` (string) - unique request identifier.
  ++ idempotency_key: `myidempotencykey` (string) - Idempotency Key if consumer sent it, `null` otherwise.
  ++ inserted_at: `2016-11-04T16:16:20.875777` (string)
  ++ api (`API__Response`, optional)
   + status_code: 200 (number) - HTTP status code.
  -+ ip_address: 10.2.87.0 (string) - Consumer IP address.
  ++ ip_address: `10.2.87.0` (string) - Consumer IP address.
   
   ### `Request_Expanded`
   + Include Request
  -+ updated_at: 2016-11-04T16:16:20.875777 (string)
  ++ updated_at: `2016-11-04T16:16:20.875777` (string)
   + request (object, fixed-type)
       + method: GET (string)
       + uri: /mypath (string)
  
positive.code: 3. When authorizing consumers set correct scope to receive JWT token with `app_metadata`: `scope=openid app_metadata`.
  4. Whenever you make requests to Annon, use `id_token` from Auth0 response (it's a JWT token that we need) in a `Authorization: Bearer <id_token>` header.
  
  ### Bind JWT Plugin [POST /apis/{api_id}/plugins]
  
  + Parameters
      + api_id: 1 (string) - API ID.
  
  + Request (application/json)
      + Attributes (Plugin_JWT)
        + name: jwt (string, required)
  
  + Response 201 (application/json)
      + Attributes (Response_OK)
          + meta (Response__Meta)
              + code: 201 (number)
          + data (Plugin_JWT)
            + name: jwt (string)
  
  ### Change JWT Config [PUT]
  
  + Parameters
      + api_id: 1 (string) - API ID.
  
  + Request (application/json)
      + Attributes (Plugin_JWT)
  
  + Response 200 (application/json)
      + Attributes (Response_OK)
          + data (Plugin_JWT)
            + name: jwt (string)
  
  ## Scopes Resolver [/apis/{api_id}/plugins/scopes]
  
  
negative.code: 
  To receive an valid JWT with scopes token you must:
  1. Set `app_metadata` for all your users, it should have AT LEAST one array with consumer ID:
      ``` 
      {
        "party_id": "my_consumer_id"
      }
      ```
      
  2. (Optional) If you prefer to receive scopes from Auth0 `app_metadata` should also have scopes array:
      ```
      {
        "party_id": "my_consumer_id",
  