Example for external_oauth

how do I implement keycloak_oauth on specific endpoint? e.g. /test/createUser requires keycloak_oauth but not /test/userInfo:

e.g.

{
  "components": {},
  "info": {
    "title": "test_oauth2",
    "version": "1.0"
  },
  "openapi": "3.0.3",
  "paths": {},
  "security": [],
  "servers": [
    {
      "url": "http://127.0.0.1:9000/test/"
    },
    {
      "url": "http://echo.tyk-demo.com:8080/"
    }
  ],
  "x-tyk-api-gateway": {
    "info": {
      "id": "",
      "name": "test_oauth2",
      "state": {
        "active": true
      }
    },
    "upstream": {
      "url": "http://echo.tyk-demo.com:8080/"
    },
    "server": {
      "listenPath": {
        "value": "/test/",
        "strip": true
      },
      "authentication": {
            "enabled": true,
            "securitySchemes": {
                "keycloak_oauth": {
                    "enabled": true,
                    "header": {
                      "enabled": true,
                      "name": "Authorization"
                    },
                    "providers": [
                      {
                        "introspection": {
                          "enabled": true,
                          "url": "http://localhost:8080/realms/tyk/protocol/openid-connect/token/introspect",
                          "clientId": "introspection-client",
                          "clientSecret": "DKyFN0WXu7IXWzR05QZOnnSnK8uAAZ3U",
                          "identityBaseField": "sub",
                          "cache": null
                        }
                      }
                    ]
                }
            }
        }
    }
  }
}