---
title: "PATCH /api/v3/gateways/{gatewayId}"
method: PATCH
path: "/api/v3/gateways/{gatewayId}"
tags: ["Gateways"]
---

# PATCH /api/v3/gateways/{gatewayId}

`PATCH /api/v3/gateways/{gatewayId}`

## Path parameters

- `gatewayId` string, uuid, required

## Request body

- object
  - `authMethod` union — Replacement auth method. Same shape as in create: `aws` with allowlists, `kubernetes` with cluster config, or `token` with no config. Existing gateways keep working until they restart and re-authenticate via the new method.
    - object
      - `method` 'aws', required
      - `stsEndpoint` string — The endpoint URL for the AWS STS API.
      - `allowedPrincipalArns` string — The comma-separated list of trusted IAM principal ARNs that are allowed to authenticate with Infisical.
      - `allowedAccountIds` string — The comma-separated list of trusted AWS account IDs that are allowed to authenticate with Infisical.
    - object
      - `method` 'kubernetes', required
      - `kubernetesHost` string — The URL of the Kubernetes API server that Infisical reviews the gateway's service account token against (e.g. https://my-cluster.example.com:6443). Omit only when tokenReviewMode is 'gateway', where the reviewing gateway calls its own API server.
      - `caCertificate` string — The PEM-encoded CA certificate that issued the Kubernetes API server's TLS certificate. Required when the API server uses a certificate the system trust store does not recognise, which is the usual case for a cluster CA.
      - `tokenReviewerJwt` string — A long-lived service account token with the system:auth-delegator ClusterRole used to submit TokenReview requests. Omit to have the gateway's own token act as the reviewer. Write-only: never returned by the API.
      - `tokenReviewMode` 'api' | 'gateway' — Who performs the TokenReview. 'api' means Infisical does, using the configured token reviewer JWT. 'gateway' means the selected gateway does, using its own in-cluster service account, which requires no Kubernetes host or reviewer token but requires that gateway to run as a pod in the cluster.
      - `gatewayId` string, uuid, nullable — The gateway to route TokenReview traffic through, for clusters whose API server Infisical cannot reach. Must be a different gateway that is already enrolled and connected. Mutually exclusive with gatewayPoolId.
      - `gatewayPoolId` string, uuid, nullable — The gateway pool to route TokenReview traffic through. Any healthy member performs the request, so this survives a single gateway going offline. Mutually exclusive with gatewayId.
      - `allowedNamespaces` string, required — The comma-separated list of Kubernetes namespaces whose service accounts are allowed to authenticate as this gateway. Supports `*` wildcards.
      - `allowedNames` string, required — The comma-separated list of Kubernetes service account names that are allowed to authenticate as this gateway. Supports `*` wildcards.
      - `allowedAudience` string — The audience the gateway's service account token must carry. Leave empty to skip the audience check.
      - `verifyTlsCertificate` boolean — Whether to verify the Kubernetes API server's TLS certificate. Verified against the CA certificate when one is configured, otherwise against the system trust store.
    - object
      - `method` 'token', required

## Response `200`

Default Response

- object
  - `id` string, uuid, required
  - `identityId` string, uuid, nullable
  - `name` string, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `heartbeat` string, date-time, nullable
  - `heartbeatTTL` number, nullable
  - `canRevoke` boolean, required
  - `authMethod` union, required
    - object
      - `method` 'aws', required
      - `config` object, required
        - `id` string, uuid, required
        - `stsEndpoint` string, required
        - `allowedPrincipalArns` string, required
        - `allowedAccountIds` string, required
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
    - object
      - `method` 'kubernetes', required
      - `config` object, required
        - `id` string, uuid, required
        - `kubernetesHost` string, required
        - `tokenReviewMode` string, required
        - `gatewayId` string, nullable, required
        - `gatewayPoolId` string, nullable, required
        - `allowedNamespaces` string, required
        - `allowedNames` string, required
        - `allowedAudience` string, required
        - `verifyTlsCertificate` boolean, required
        - `caCertificate` string, required
        - `hasTokenReviewerJwt` boolean, required
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
    - object
      - `method` 'token', required
      - `config` object, required
    - object
      - `method` 'identity', required
      - `config` object, required
        - `identityId` string, required
        - `identityName` string, nullable, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/483aceca65ba/schema)