The whole config, in one block.

// The same object, minus the comments, can live inline in the page as
// strict JSON: <script id="api-doc-config" type="application/json">{ … }</script>
window.API_DOC_CONFIG = {
  openapi: {
    // The only required key: your schema, JSON or YAML, CORS-readable.
    url: "https://example.com/openapi.json",
    // …or carry the schema in the page — no request, no CORS; wins over url.
    // spec: { openapi: "3.1.0", … },
    // …or several APIs in one install; almost every key below can be
    // redeclared per entry. Wins over url.
    // specs: [{ id: "payments", title: "Payments API", url: "…" }],
    // default: "payments",              // spec shown on arrival (multi-spec)
    // Documentation hiding, not access control — by tag, method + path,
    // path, or operationId.
    hide: ["tag:Internal", "DELETE /admin/*"],
    // OpenAPI Overlay 1.1 documents applied to the schema at load, in order.
    overlays: ["/overlays/fix-descriptions.json"],
    // A starting patch seeded into the reader's own overlay editor.
    userOverlay: null
  },
  theme: {
    default: "light",                    // first-load theme (default "system" follows the OS); the reader's choice wins afterward
    available: ["light", "dark", "nord"], // selector entries — all 35 daisyUI themes are bundled
    custom: [                            // your own theme, no build step (root-only in multi-spec)
      { name: "acme", extends: "dark", tokens: { "--color-primary": "#7c3aed" } }
    ]
  },
  language: {
    default: "browser",                  // follows the browser's languages; or pin a code
    available: ["en", "fr"]              // non-active languages download on demand
  },
  environments: [                        // pre-filled on first load; the reader's storage then wins
    {
      name: "sandbox",
      color: "green",                    // red flags production at a glance
      baseUrl: "https://sandbox.example.com",
      variables: { "auth.bearerAuth": { value: "demo-token", sensitive: true } },
      defaultHeaders: { "X-Client": "docs" }
    }
  ],
  environmentsLocked: false,             // true removes every create/edit entry point
  docsPages: [                           // your markdown guides, woven into the nav
    { slug: "getting-started", title: "Getting started", url: "/docs/getting-started.md" },
    { slug: "changelog", title: "Changelog", url: "/docs/changelog.md", kind: "changelog" },
    // nav: "bottom" sends a top-level entry to the appendix zone, below the reference.
    { slug: "support", title: "Support", url: "/docs/support.md", nav: "bottom" }
  ],
  announcements: [                       // a strip above the header — or "/news.json", a file your ops team edits
    { id: "v2", text: "**v2 is live** — see the [migration guide](/migrate).", level: "info" },
    { text: "Maintenance Sunday, 02:00–06:00 UTC.", level: "warning", dismissible: false,
      startsAt: "2026-09-01T00:00:00Z", endsAt: "2026-09-07T06:00:00Z" }
  ],
  feedback: {
    url: null                            // your endpoint for "Was this page helpful?" — null removes the row
  },
  scenarios: [                           // executable scenarios shipped with the docs
    { id: "first-order", title: "Order a pet", url: "/scenarios/first-order.json", pinned: true }
  ],
  features: {
    scenarios: true,                     // false removes the whole feature
    audit: true,                         // false removes the schema audit
    onboarding: false,                   // true adds the generated "First call" page (#/first-call)
    ci: true                             // false removes the "Automate this scenario" panel
  },
  audit: {                               // rule configuration, read by #/audit and by `apiglow audit` alike
    rules: { "property-described": "off" },   // rule id → "error" | "warning" | "info" | "off"
    overrides: [                         // the same, under JSON pointer patterns — the last match wins
      { paths: ["/paths/~1legacy~1*"], rules: { "response-example": "off" }, reason: "frozen legacy API" }
    ]
  },
  branding: {
    productName: "Acme API",             // header name
    logoUrl: "/logo.svg"                 // header logo
  },
  tryIt: {
    proxyUrl: null,                      // optional CORS proxy you host — "{{target}}" = encoded target URL
    requestCredentials: "same-origin"    // "include" for cross-origin session-cookie auth
  },
  history: {
    maxEntries: 500,                     // purge beyond this count…
    maxAgeDays: 30                       // …or this age (root-only in multi-spec)
  },
  oauth: {
    // Key = the scheme's name in securitySchemes. Never a client secret.
    acme_auth: { clientId: "public-client-id" }
  },
  seo: {
    index: true                          // false injects a robots noindex before first paint (root-only)
  }
}