---
title: "Returns MeshTLS entity"
method: GET
path: "/v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtlses/{name}"
tags: ["MeshTLS"]
---

# Returns MeshTLS entity

`GET /v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtlses/{name}`

## Path parameters

- `mesh` string, required
- `name` string, required

## Response `200`

Successful response

- MeshTLSItem — MeshTLS configures TLS and mutual TLS (mTLS) settings for secure communication between services in the mesh. It allows you to enforce encryption, configure TLS versions and cipher suites, and control whether mTLS is required (strict mode) or optional (permissive mode) for inbound traffic.
  - `type` 'MeshTLS', required — the type of the resource
  - `mesh` string — Mesh is the name of the Kuma mesh this resource belongs to. It may be omitted for cluster-scoped resources.
  - `kri` string — A unique identifier for this resource instance used by internal tooling and integrations. Typically derived from resource attributes and may be used for cross-references or indexing
  - `name` string, required — Name of the Kuma resource
  - `labels` object — The labels to help identity resources
  - `spec` object, required — Spec is the specification of the Kuma MeshTLS resource.
    - `from` object[] — From list makes a match between clients and corresponding configurations
      - `default` object — Default is a configuration specific to the group of clients referenced in 'targetRef'
        - `mode` 'Permissive' | 'Strict' — Mode defines the behavior of inbound listeners with regard to traffic encryption.
        - `tlsCiphers` string[] — TlsCiphers section for providing ciphers specification.
        - `tlsVersion` object — Version section for providing version specification.
          - `max` 'TLSAuto' | 'TLS10' | 'TLS11' | 'TLS12' | 'TLS13' — Max defines maximum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
          - `min` 'TLSAuto' | 'TLS10' | 'TLS11' | 'TLS12' | 'TLS13' — Min defines minimum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
      - `targetRef` object, required — TargetRef is a reference to the resource that represents a group of clients.
        - `kind` 'Mesh' | 'MeshSubset' | 'MeshGateway' | 'MeshService' | 'MeshExternalService' | 'MeshMultiZoneService' | 'MeshServiceSubset' | 'MeshHTTPRoute' | 'Dataplane', required — Kind of the referenced resource
        - `labels` object — Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespace can be used.
        - `mesh` string — Mesh is reserved for future use to identify cross mesh resources.
        - `name` string — Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and `MeshGatewayRoute`
        - `namespace` string — Namespace specifies the namespace of target resource. If empty only resources in policy namespace will be targeted.
        - `proxyTypes` string[] — ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all data plane types are targeted by the policy.
        - `sectionName` string — SectionName is used to target specific section of resource. For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
        - `tags` object — Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshServiceSubset`
    - `rules` object[] — Rules defines inbound tls configurations. Currently limited to selecting all inbound traffic, as L7 matching is not yet implemented.
      - `default` object — Default contains configuration of the inbound tls
        - `mode` 'Permissive' | 'Strict' — Mode defines the behavior of inbound listeners with regard to traffic encryption.
        - `tlsCiphers` string[] — TlsCiphers section for providing ciphers specification.
        - `tlsVersion` object — Version section for providing version specification.
          - `max` 'TLSAuto' | 'TLS10' | 'TLS11' | 'TLS12' | 'TLS13' — Max defines maximum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
          - `min` 'TLSAuto' | 'TLS10' | 'TLS11' | 'TLS12' | 'TLS13' — Min defines minimum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
    - `targetRef` object — TargetRef is a reference to the resource the policy takes an effect on. The resource could be either a real store object or virtual resource defined in-place.
      - `kind` 'Mesh' | 'MeshSubset' | 'MeshGateway' | 'MeshService' | 'MeshExternalService' | 'MeshMultiZoneService' | 'MeshServiceSubset' | 'MeshHTTPRoute' | 'Dataplane', required — Kind of the referenced resource
      - `labels` object — Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespace can be used.
      - `mesh` string — Mesh is reserved for future use to identify cross mesh resources.
      - `name` string — Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and `MeshGatewayRoute`
      - `namespace` string — Namespace specifies the namespace of target resource. If empty only resources in policy namespace will be targeted.
      - `proxyTypes` string[] — ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all data plane types are targeted by the policy.
      - `sectionName` string — SectionName is used to target specific section of resource. For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
      - `tags` object — Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshServiceSubset`
  - `creationTime` string, date-time — Time at which the resource was created
  - `modificationTime` string, date-time — Time at which the resource was updated

## Other responses

- `404` — Not Found

---

[API](https://skmtc.net/kong/apis/konnect-api-beta.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-beta/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-beta/versions/73b05fbfd2ef/schema)