caption: Configure Proxy Provisioning Domains
desc: |-
  Configures a list of Provisioning Domains (PvDs) that <ph name="PRODUCT_NAME">Google Chrome</ph> will use to fetch proxy configurations dynamically.

  This policy allows specifying a list of domain names or resource URIs representing Provisioning Domains as defined in RFC 8801 ("Discovering Provisioning Domain Names and Data"). For each PvD, the browser resolves the corresponding JSON configuration by making an HTTPS request to the well-known endpoint path: "https://[<ph name="PROXY_PROVISIONING_DOMAINS_PVD_ID">pvd_id</ph>]/.well-known/pvd".

  Each entry in the list specifies:

  * <ph name="PROXY_PROVISIONING_DOMAINS_PVD_ID">pvd_id</ph>: The identifier of the Provisioning Domain (a domain name).

  * <ph name="PROXY_PROVISIONING_DOMAINS_AUTH_CONFIG">auth_config</ph>: The optional authentication configuration. If unconfigured or set to "none", no authentication is performed. When set to "profile_bearer_token", the browser retrieves an OAuth2 access token with provided scope for the signed-in primary account and attaches it in the "Authorization" header as a "Bearer" token.

  * <ph name="PROXY_PROVISIONING_DOMAINS_EXTRA_HEADERS">extra_headers</ph>: An optional list of custom HTTP headers to include when querying the PvD endpoint. Dynamic values can be injected, such as "profile_id" (which represents a stable, unique identifier of the browser profile on the device, enabling per-profile configuration targeting) or "accept_language" (representing the browser's preferred languages).

  The fetched configurations are parsed according to the RFC 8801 schema. Only proxy configuration-related routing rules and proxies from the PvD's JSON payload are applied. If this policy is unset, no Provisioning Domains will be queried or used to fetch proxy configurations.

example_value:
- pvd_id: 'https://api.prod.securegateway.goog:443'
  auth_config:
    type: 'profile_bearer_token'
    scope: 'cloud_secure_gateway'
  extra_headers:
  - key: 'x-resource-key'
    value: 'arbitrary-resource-key-value'
  - key: 'x-profile-id'
    value: '${profile_id}'
  - key: 'accept-language'
    value: '${accept_language}'

features:
  cloud_only: true
  dynamic_refresh: true
  per_profile: true

future_on:
- chrome.*
- chrome_os
- android
- ios

owners:
- seblalancette@chromium.org
- xzonghan@chromium.org

schema:
  type: array
  items:
    type: object
    properties:
      pvd_id:
        type: string
        description: The PvD ID of the Provisioning Domain. The full URL of the PvD will be https://[PvD-ID]/.well-known/pvd.
      auth_config:
        type: object
        description: Authentication configuration for the PvD.
        properties:
          type:
            type: string
            enum:
            - 'none'
            - 'profile_bearer_token'
            description: |-
              The type of authentication.

              * 'none': No authentication is performed.

              * 'profile_bearer_token': Instructs the browser to fetch an OAuth2 access token for the signed-in primary account and attach it in the "Authorization" header as a "Bearer" token.
          scope:
            type: string
            description: The OAuth scope or purpose identifier. Only relevant when type is profile_bearer_token.
      extra_headers:
        type: array
        items:
          type: object
          description: Additional HTTP headers to include in the fetch request.
          properties:
            key:
              type: string
              description: The key of the header.
            value:
              type: string
              description: |-
                The value of the header, which can contain placeholders that the browser will expand dynamically:

                * '${profile_id}': Expands to a stable, unique identifier representing the specific browser profile on the device (as generated by the browser's Profile ID Service).

                * '${accept_language}': Expands to the browser's current preferred languages.
          required:
          - key
          - value
    required:
    - pvd_id

tags:
- system-security
type: dict
