anchor.diff:              + code: 201 (number)
           + data (`Plugin_Auth__Response`)
   
  +## ACL [/apis/{api_id}/plugins/acl]
  +
  +ACL allows to set scope to access certain subpaths of your API. 
  +
  +Once enabled it will restrict access to all subpaths of API, and you 
  +need to allow access to them by whitelisting paths or path patterns.
  +
  +It expects scope to be set in Auth plugin, if scope is not set, 
  +API consumers will receive responses `unathorized` error.
  +
  +Proxy configuration consist of pattern matches on request method and path:
  +
  +```
  +rules: [
  +    {methods: ["GET", "POST", "PUT", "DELETE"], path: ".*", scopes: ["request_api"]},
  +    {methods: ["GET"], path: "^/profiles/me", scopes: ["read_profile"]},
  +    {methods: ["POST", "PUT"], path: "^/profiles/me", scopes: ["update_profile"]},
  +    {methods: ["DELETE"], path: "^/profiles/me", scopes: ["delete_profile"]}
  +]
  +```
  +
  +Path is relative to API path, so you **don't need to specify API path prefix**!
  +
  +**All rules is applied in a order they were defined.**
  +
  +### Bind or Update ACL Plugin [PUT]
  +
  ++ Parameters
  +    + api_id: 1 (string, required) - API ID.
  +
  ++ Request (application/json)
  +    + Attributes
  +        + plugin (`Plugin_ACL__Request`)
  +
  ++ Response 200 (application/json)
  +    + Attributes (Response_OK)
  +        + data (`Plugin_ACL__Response`)
  +
  ++ Response 201 (application/json)
  +    + Attributes (Response_OK)
  +        + meta (Response__Meta)
  +            + code: 201 (number)
  +        + data (`Plugin_ACL__Response`)
  +
  +## Validator [/apis/{api_id}/plugins/validator]
  +
  +Validator plugin allows to set a [JSON Schema](http://json-schema.org/) to validate request to a API by pattern mathching request path:
  +
  +```
  +rules: [
  +    {methods: ["POST", "PUT"], path: ".*", schema: "{}"},
  +    {methods: ["POST"], path: "^/profiles/me", schema: "{}"}
  +]
  +```
  +
  +Path is relative to API path, so you **don't need to specify API path prefix**!
  +
  +**All rules is applied in a order they were defined.**
  +
  +### Bind or Update Validator Plugin [PUT]
  +
  ++ Parameters
  +    + api_id: 1 (string, required) - API ID.
  +
  ++ Request (application/json)
  +    + Attributes
  +        + plugin (`Plugin_Validator__Request`)
  +
  ++ Response 200 (application/json)
  +    + Attributes (Response_OK)
  +        + data (`Plugin_Validator__Response`)
  +
  ++ Response 201 (application/json)
  +    + Attributes (Response_OK)
  +        + meta (Response__Meta)
  +            + code: 201 (number)
  +        + data (`Plugin_Validator__Response`)
  +
  +## Idempotency [/apis/{api_id}/plugins/idempotency]
  +
  +Gateway supports idempotency for safely retrying POST requests without accidentally duplicating entity. Gateway always send back the same response for requests made with the same key. 
  +However, you cannot use the same key with different request parameters.
  +
  +To perform an idempotent request, send a POST requests with `X-Idempotency-Key: <idempotency_key>` header. `idempotency_key` can be any unique string up to 255 characters, we recommend to use UUIDs.
  +
  +Enabling idempotency will increase response latency - Requests will be created synchronously to enshure read-after-write consistency.
  +
  +### Bind or Update Idempotency Plugin [PUT]
  +
  ++ Parameters
  +    + api_id: 1 (string, required) - API ID.
  +
  ++ Request (application/json)
  +    + Attributes
  +        + plugin (`Plugin_Idempotency__Request`)
  +
  ++ Response 200 (application/json)
  +    + Attributes (Response_OK)
  +        + data (`Plugin_Idempotency__Response`)
  +
  ++ Response 201 (application/json)
  +    + Attributes (Response_OK)
  +        + meta (Response__Meta)
  +            + code: 201 (number)
  +        + data (`Plugin_Idempotency__Response`)
  +
  +## IP Restriction [/apis/{api_id}/plugins/ip_restriction]
  +
  +Whitelist or blacklist IP ranges from accessing an API.
  +
  +You can specify matches by replacing ranges with `*`.
  +
  +Rules applied in a predicted order:
  +
  +* If there is an ip whitelist - block requests from IP's that not in this list.
  +* If IP is in blacklist and not in white list - block request.
  +* If IP is in blacklist and in whitelist - allow request.
  +
  +### Bind or Update IP Restriction Plugin [PUT]
  +
  ++ Parameters
  +    + api_id: 1 (string, required) - API ID.
  +
  ++ Request (application/json)
  +    + Attributes
  +        + plugin (`Plugin_IP_Restriction__Request`)
  +
  ++ Response 200 (application/json)
  +    + Attributes (Response_OK)
  +        + data (`Plugin_IP_Restriction__Response`)
  +
  ++ Response 201 (application/json)
  +    + Attributes (Response_OK)
  +        + meta (Response__Meta)
  +            + code: 201 (number)
  +        + data (`Plugin_IP_Restriction__Response`)
  +
  +## User Agent Restriction [/apis/{api_id}/plugins/ua_restriction]
  +
  +Whitelist or blacklist User Agents from accessing an API.
  +
  +You can specify matches by replacing ranges with `*`.
  +
  +Rules applied in a predicted order:
  +
  +* If there is an User Agent whitelist - block requests from User Agents that not in this list.
  +* If User Agent is in blacklist and not in white list - block request.
  +* If User Agent is in blacklist and in whitelist - allow request.
  +
  +### Bind or Update User Agent Restriction Plugin [PUT]
  +
  ++ Parameters
  +    + api_id: 1 (string, required) - API ID.
  +
  ++ Request (application/json)
  +    + Attributes
  +        + plugin (`Plugin_UA_Restriction__Request`)
  +
  ++ Response 200 (application/json)
  +    + Attributes (Response_OK)
  +        + data (`Plugin_UA_Restriction__Response`)
  +
  ++ Response 201 (application/json)
  +    + Attributes (Response_OK)
  +        + meta (Response__Meta)
  +            + code: 201 (number)
  +        + data (`Plugin_UA_Restriction__Response`)
  +
  +## CORS [/apis/{api_id}/plugins/cors]
  +
  +Plugin allows to request your APIs with Cross-Origin Resource Sharing (CORS) mechanism.
  +
  +When enabled requests to API will return the following headers:
  +
  +On preflight (`OPTIONS`) requests:
  +
  +- `Access-Control-Allow-Origin`
  +- `Access-Control-Allow-Credentials`
  +- `Access-Control-Max-Age`
  +- `Access-Control-Allow-Headers`
  +- `Access-Control-Allow-Methods`
  +
  +On `GET`, `POST`, `PUT` and other requests:
  +
  +- `Access-Control-Allow-Origin`
  +- `Access-Control-Expose-Headers`
  +- `Access-Control-Allow-Credentials`
  +
  +### Bind or Update CORS Plugin [PUT]
  +
  ++ Parameters
  +    + api_id: 1 (string, required) - API ID.
  +
  ++ Request (application/json)
  +    + Attributes
  +        + plugin (`Plugin_CORS__Request`)
  +
  ++ Response 200 (application/json)
  +    + Attributes (Response_OK)
  +        + data (`Plugin_CORS__Response`)
  +
  ++ Response 201 (application/json)
  +    + Attributes (Response_OK)
  +        + meta (Response__Meta)
  +            + code: 201 (number)
  +        + data (`Plugin_CORS__Response`)
   
   ## Rate Limit [/apis/{api_id}/plugins/rate_limit]
   
  
positive.code: ## JWT Plugin
  ### `Plugin_JWT__Request`
  + name: jwt (string, required)
  + is_enabled: true (boolean)
  + settings (Plugin_JWT__Settings, fixed-type)
  
  ### `Plugin_JWT__Response`
  
negative.code:             + code: 201 (number)
          + data (`Plugin_Proxy__Response`)
  
  ## Authentication [/apis/{api_id}/plugins/auth]
  
  This plugin authenticates API consumers by using a configured strategy.
  
  Right now it supports two strategies:
  
  - `jwt` - uses JSON Web Token to resolve consumer ID and scope.
  - `oauth` - uses token from `Authorization: Bearer <token>` header and subsequent request to resolve consumer ID and scope via third-party provider.
  
  ### JWT Strategy
  
  Decodes JWT tokens received from API Consumer and validates it signature by a configured secret key.
  If token is invalid, appropriate error response will be send back to api consumer.
  
  It requests `consumer_id` to be present in token itself, but Consumer `scope` can be resolved by:
  
  1. Adding `scope` field in JWT token.
  2. Subsequent request to a third-party provider.
  
  **Warning!** JWT signature should be Base64 encoded. Some providers (for example, Auth0) already encode it for you.
  
  #### Consumer Usage
  
  Consumer should send `Authorization: Bearer <jwt_token>` header with his requests.
  
  #### Subsequent requests
  
  You can configure this strategy to resolve consumer scope by a subsequent request to a 
  third-party provider, in this case GET request will be send to `url_template` 
  with substituted `{consumer_id}`. Annon will expect `HTTP 200` response in following format:
  
  ```
  {
    "data": {
      "user_id": "user-dsljsdflkdflj",
      "details": {
          "scope": "originator_loans:upload"
      }
    }
  }
  ```
  `$.data.user_id` will be mapped to Consumer ID.
  `$.data.details.scope` will be mapped to Consumer Scope.
  
  **OR**
  
  ```
  {
    "data": {
      "consumer_id": "user-dsljsdflkdflj",
      "consumer_scope": "originator_loans:upload"
    }
  }
  ```
  