diff --git a/api/base.proto b/api/base.proto
index f4b7946e6..7f6e67953 100644
--- a/api/base.proto
+++ b/api/base.proto
@@ -157,6 +157,22 @@ message HeaderValueOption {
   google.protobuf.BoolValue append = 2;
 }
 
+// Data source consisting of either a file or an inline value.
+message DataSource {
+  oneof specifier {
+    option (validate.required) = true;
+
+    // Local filesystem data source.
+    string filename = 1 [(validate.rules).string.min_bytes = 1];
+
+    // Bytes inlined in the configuration.
+    bytes inline_bytes = 2 [(validate.rules).bytes.min_len = 1];
+
+    // String inlined in the configuration.
+    string inline_string = 3 [(validate.rules).string.min_bytes = 1];
+  }
+}
+
 // API configuration source. This identifies the API type and cluster that Envoy
 // will use to fetch an xDS API.
 message ApiConfigSource {
diff --git a/api/rds.proto b/api/rds.proto
index 531ace44c..a45dcd301 100644
--- a/api/rds.proto
+++ b/api/rds.proto
@@ -178,6 +178,9 @@ message Route {
 
     // Return a redirect.
     RedirectAction redirect = 3;
+
+    // [#not-implemented-hide:] Return an arbitrary HTTP response directly, without proxying.
+    DirectResponseAction direct_response = 7;
   }
 
   // The Metadata field can be used to provide additional information
@@ -585,6 +588,20 @@ message RedirectAction {
   RedirectResponseCode response_code = 3 [(validate.rules).enum.defined_only = true];
 }
 
+message DirectResponseAction {
+  // Specifies the HTTP response status to be returned.
+  uint32 status = 1 [(validate.rules).uint32 = {gte: 100, lt: 600}];
+
+  // Specifies the content of the response body. If this setting is omitted,
+  // no body is included in the generated response.
+  //
+  // .. note::
+  //
+  //   Headers can be specified using *response_headers_to_add* in
+  //   :ref:`envoy_api_msg_RouteConfiguration`.
+  DataSource body = 2;
+}
+
 message Decorator {
   // The operation name associated with the request matched to this route. If tracing is
   // enabled, this information will be used as the span name reported for this request.
diff --git a/api/sds.proto b/api/sds.proto
index e4b1bae4f..0310f0098 100644
--- a/api/sds.proto
+++ b/api/sds.proto
@@ -24,18 +24,6 @@ service SecretDiscoveryService {
   }
 }
 
-message DataSource {
-  oneof specifier {
-    option (validate.required) = true;
-
-    // Local filesystem data source.
-    string filename = 1 [(validate.rules).string.min_bytes = 1];
-
-    // Bytes inlined in the configuration.
-    bytes inline = 2 [(validate.rules).bytes.min_len = 1];
-  }
-}
-
 message TlsParameters {
   enum TlsProtocol {
     // Envoy will choose the optimal TLS version.