Filter resources by API still extracts all resources not related to API?

[htwashere]

Question

According to the explanation on the filter configuration, if I specify the filter key "apis", it should only extract the api and its transitive dependencies only. My test shows that although it filtered the API correctly, but all of the other resources seem to be extracted as well even though they don't belong to this API. My configuration.extractor.yaml was very simple:

# Extract only specific APIs by name (or wildcard pattern)
apis:
  - my-own-api

But the extractor extracted this many resources:

2026-07-02T17:08:06.285Z [INFO] Extraction complete: 384 resources extracted, 0 errors
Extracted 1 Workspace(s)
Extracted 11 NamedValue(s)
Extracted 213 Tag(s)
Extracted 4 VersionSet(s)
Extracted 30 Backend(s)
Extracted 6 Logger(s)
Extracted 3 Group(s)
Extracted 2 Diagnostic(s)
Extracted 15 Product(s)
Extracted 66 Subscription(s)

Context

No response

[petehauge]

Thanks for following up with us! It looks like the behavior isn't very clear in the docs, I'll fix that up so it's more obvious!

Each top-level filter key is independent, and the semantics are:

key omitted → include all resources of that type (default)
key: [] → include none
key: [names] → allowlist
Your configuration.extractor.yaml only sets apis:, so namedValues, backends, products, tags, workspaces, etc. are all omitted and default to include-all. That's why you saw the full inventory even though the apis allowlist worked correctly.

To extract only my-own-api and its transitive dependencies, exclude everything else explicitly:

apis:
  - my-own-api
backends: []
namedValues: []
products: []
tags: []
versionSets: []
loggers: []
diagnostics: []
groups: []
policyFragments: []
gateways: []
schemas: []
subscriptions: []
policies: []
policyRestrictions: []
workspaces: []

With transitive resolution enabled (the default), any version set, backend, named value, policy fragment, or tag directly referenced by my-own-api or its policies will still be pulled in automatically even though those keys are [].

I just re-ran your filter against a test instance (73 resources extracted, matching your pattern) and then the explicit-exclude version (12 resources: just the API + its transitive deps)..

I'll follow up with a docs PR to make the omitted-vs-[] distinction more prominent, since this trips people up. Please follow up if it doesn't work as described above!

[htwashere]

Thank you! It works beautifully.