--- title: "List MCP Servers" method: GET path: "/v1/ai-gateways/{gatewayId}/mcp-servers" tags: ["AI Gateway MCP Servers"] --- # List MCP Servers `GET /v1/ai-gateways/{gatewayId}/mcp-servers` **Pre-release Endpoint** This endpoint is currently in beta and is subject to change. Returns a list of MCP Servers configured for the AI Gateway. ## Query parameters - `page[size]` integer - `page[after]` string ## Response `200` A paginated list of MCP Servers. - object - `data` AIGatewayMCPServer[], required - union — **Pre-release Feature** This feature is currently in beta and is subject to change. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `type` 'conversion-only', required - `config` AIGatewayMCPServerWithUpstreamNoProxyConfigNoServerConfig, required — **Pre-release Feature** This feature is currently in beta and is subject to change. Routing, logging, and request body size limits for the MCP Server. - `route` AIGatewayRouteConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an AI Gateway route. - `headers` object — One or more lists of values indexed by header name that will cause this route to match if present in the request. The `Host` header cannot be used with this attribute: hosts should be specified using the `hosts` attribute. When `headers` contains only one value and that value starts with the special prefix `~*`, the value is interpreted as a regular expression. - `hosts` string[] — A list of domain names that match this route. Note that the hosts value is case sensitive. - `https_redirect_status_code` integer — The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is `HTTP` instead of `HTTPS`. `Location` header is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept the `https` protocol. - `methods` string[] — A list of HTTP methods that match this route. - `paths` string[] — A list of paths that match this route. - `preserve_host` boolean — When matching a route via one of the `hosts` domain names, use the request `Host` header in the upstream request headers. If set to `false`, the upstream `Host` header will be that of the service's `host`. - `protocols` string[] — An array of the protocols this route should allow. See the [route Object](#route-object) section for a list of accepted protocols. When set to only `https`, HTTP requests are answered with an upgrade error. When set to only `http`, HTTPS requests are answered with an error. - `regex_priority` integer — A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same `regex_priority`, the older one (lowest `created_at`) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). - `request_buffering` boolean — Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. - `response_buffering` boolean — Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. - `strip_path` boolean — When matching a route via one of the `paths`, strip the matching prefix from the upstream request URL. - `tags` string[] — An optional set of strings associated with the route for grouping and filtering. - `logging` object — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for AI Gateway logging. - `payloads` boolean - `audits` boolean - `max_request_body_size` integer — Maximum size of request body to parse. Set to 0 for unlimited. - `url` string, uri, required — Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} - `upstream` AIGatewayUpstreamConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration applied when proxying to the upstream service, including authentication. - `auth` AIGatewayUpstreamAuthAWS — **Pre-release Feature** This feature is currently in beta and is subject to change. AWS IAM (SigV4) authentication for the upstream service. - … - `tools` AIGatewayMCPConversionTool[] — List of tools exposed by this MCP Server. - `access` object - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `annotations` AIGatewayMCPToolAnnotations — **Pre-release Feature** This feature is currently in beta and is subject to change. - `destructive_hint` boolean — If true, the tool may perform destructive updates - `idempotent_hint` boolean — If true, repeated calls with same args have no additional effect - `open_world_hint` boolean — If true, tool interacts with external entities - `read_only_hint` boolean — If true, the tool does not modify its environment - `title` string — Human-readable title for the tool - `description` string, required — A description of what the tool does. - `headers` AIGatewayMCPToolHeaders — **Pre-release Feature** This feature is currently in beta and is subject to change. The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. - `host` string — The host of the exported API, which must match the route's hosts. It should be the route's host. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required. - `name` string, required — Tool identifier. In passthrough-listener mode, used to match remote MCP Server tools for ACL enforcement. In other modes, it is also used as the tool name (overrides annotations.title if present). - `method` 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT', required — For conversion-only and conversion-listener modes, the method of the exported API, which must match the route's methods. - `path` string — The path of the exported API, which must match the route's paths. Path not starting with '/' are treated as relative path and the route path will be added as the prefix. By default, Kong will extract the path from API configuration. - `query` AIGatewayMCPToolQuery — **Pre-release Feature** This feature is currently in beta and is subject to change. The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. - `request_body` AIGatewayMCPToolRequestBody — **Pre-release Feature** This feature is currently in beta and is subject to change. The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported. - `responses` AIGatewayMCPToolResponses — **Pre-release Feature** This feature is currently in beta and is subject to change. The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported. - `scheme` 'http' | 'https' — The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. - `parameters` AIGatewayMCPToolParameter[] — **Pre-release Feature** This feature is currently in beta and is subject to change. - `name` string, required — The name of the parameter. - `in` 'query' | 'path' | 'header' | 'body', required — The location of the parameter in the request. - `description` string — A description of the parameter. - `required` boolean — Whether this parameter is required. - `schema` object — JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details. - `display_name` string, required — The display name for the MCP Server. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `enabled` boolean — Whether the MCP Server is enabled. - `policies` string[] — List of policy references. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `type` 'conversion-listener', required - `config` AIGatewayMCPServerWithUpstreamNoProxyConfig, required — **Pre-release Feature** This feature is currently in beta and is subject to change. Routing, logging, and server configuration for the MCP Server. - `route` AIGatewayRouteConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an AI Gateway route. - `headers` object — One or more lists of values indexed by header name that will cause this route to match if present in the request. The `Host` header cannot be used with this attribute: hosts should be specified using the `hosts` attribute. When `headers` contains only one value and that value starts with the special prefix `~*`, the value is interpreted as a regular expression. - `hosts` string[] — A list of domain names that match this route. Note that the hosts value is case sensitive. - `https_redirect_status_code` integer — The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is `HTTP` instead of `HTTPS`. `Location` header is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept the `https` protocol. - `methods` string[] — A list of HTTP methods that match this route. - `paths` string[] — A list of paths that match this route. - `preserve_host` boolean — When matching a route via one of the `hosts` domain names, use the request `Host` header in the upstream request headers. If set to `false`, the upstream `Host` header will be that of the service's `host`. - `protocols` string[] — An array of the protocols this route should allow. See the [route Object](#route-object) section for a list of accepted protocols. When set to only `https`, HTTP requests are answered with an upgrade error. When set to only `http`, HTTPS requests are answered with an error. - `regex_priority` integer — A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same `regex_priority`, the older one (lowest `created_at`) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). - `request_buffering` boolean — Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. - `response_buffering` boolean — Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. - `strip_path` boolean — When matching a route via one of the `paths`, strip the matching prefix from the upstream request URL. - `tags` string[] — An optional set of strings associated with the route for grouping and filtering. - `logging` object — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for AI Gateway logging. - `payloads` boolean - `audits` boolean - `max_request_body_size` integer — Maximum size of request body to parse. Set to 0 for unlimited. - `server` AIGatewayMCPServerServerConfigBase — **Pre-release Feature** This feature is currently in beta and is subject to change. Server-side configuration for the MCP Server. - `forward_client_headers` boolean — Whether to forward the client request headers to the upstream server when calling the tools. - `session` object — Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers. - … - `label` string — The label of the MCP server. This is used to filter the exported MCP tools. - `timeout` integer — The timeout for calling the tools in milliseconds. - `url` string, uri, required — Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} - `upstream` AIGatewayUpstreamConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration applied when proxying to the upstream service, including authentication. - `auth` AIGatewayUpstreamAuthAWS — **Pre-release Feature** This feature is currently in beta and is subject to change. AWS IAM (SigV4) authentication for the upstream service. - … - `tools` AIGatewayMCPConversionTool[] — List of tools exposed by this MCP Server. - `access` object - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `annotations` AIGatewayMCPToolAnnotations — **Pre-release Feature** This feature is currently in beta and is subject to change. - `destructive_hint` boolean — If true, the tool may perform destructive updates - `idempotent_hint` boolean — If true, repeated calls with same args have no additional effect - `open_world_hint` boolean — If true, tool interacts with external entities - `read_only_hint` boolean — If true, the tool does not modify its environment - `title` string — Human-readable title for the tool - `description` string, required — A description of what the tool does. - `headers` AIGatewayMCPToolHeaders — **Pre-release Feature** This feature is currently in beta and is subject to change. The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. - `host` string — The host of the exported API, which must match the route's hosts. It should be the route's host. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required. - `name` string, required — Tool identifier. In passthrough-listener mode, used to match remote MCP Server tools for ACL enforcement. In other modes, it is also used as the tool name (overrides annotations.title if present). - `method` 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT', required — For conversion-only and conversion-listener modes, the method of the exported API, which must match the route's methods. - `path` string — The path of the exported API, which must match the route's paths. Path not starting with '/' are treated as relative path and the route path will be added as the prefix. By default, Kong will extract the path from API configuration. - `query` AIGatewayMCPToolQuery — **Pre-release Feature** This feature is currently in beta and is subject to change. The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. - `request_body` AIGatewayMCPToolRequestBody — **Pre-release Feature** This feature is currently in beta and is subject to change. The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported. - `responses` AIGatewayMCPToolResponses — **Pre-release Feature** This feature is currently in beta and is subject to change. The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported. - `scheme` 'http' | 'https' — The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. - `parameters` AIGatewayMCPToolParameter[] — **Pre-release Feature** This feature is currently in beta and is subject to change. - `name` string, required — The name of the parameter. - `in` 'query' | 'path' | 'header' | 'body', required — The location of the parameter in the request. - `description` string — A description of the parameter. - `required` boolean — Whether this parameter is required. - `schema` object — JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details. - `access` union — **Pre-release Feature** This feature is currently in beta and is subject to change. - AIGatewayMCPServerListenerConsumer — **Pre-release Feature** This feature is currently in beta and is subject to change. Identity provider and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. - `acl_attribute_type` 'consumer', required — The type of attributes that ACL is evaluated with. - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `identity_providers` AIGatewayIdentityProviderReference[] — List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. - `metadata` AIGatewayMCPServerProtectedResourceMetadata — **Pre-release Feature** This feature is currently in beta and is subject to change. OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised for this MCP server, allowing clients to discover the authorization servers that protect it. - … - AIGatewayMCPServerListenerOauth — **Pre-release Feature** This feature is currently in beta and is subject to change. Identity provider and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. - `acl_attribute_type` 'oauth_access_token', required — The type of attributes that ACL is evaluated with. - `access_token_claim_field` string, required — The claim in the OAuth2 access token to use as the subject for ACL evaluation when `acl_attribute_type` is set to `oauth_access_token`. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `identity_providers` AIGatewayIdentityProviderReference[] — List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. - `metadata` AIGatewayMCPServerProtectedResourceMetadata — **Pre-release Feature** This feature is currently in beta and is subject to change. OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised for this MCP server, allowing clients to discover the authorization servers that protect it. - … - `display_name` string, required — The display name for the MCP Server. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `enabled` boolean — Whether the MCP Server is enabled. - `policies` string[] — List of policy references. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `type` 'listener', required - `config` AIGatewayMCPServerNoUpstreamConfig, required — **Pre-release Feature** This feature is currently in beta and is subject to change. Routing, logging, and server configuration for the MCP Server. - `route` AIGatewayRouteConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an AI Gateway route. - `headers` object — One or more lists of values indexed by header name that will cause this route to match if present in the request. The `Host` header cannot be used with this attribute: hosts should be specified using the `hosts` attribute. When `headers` contains only one value and that value starts with the special prefix `~*`, the value is interpreted as a regular expression. - `hosts` string[] — A list of domain names that match this route. Note that the hosts value is case sensitive. - `https_redirect_status_code` integer — The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is `HTTP` instead of `HTTPS`. `Location` header is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept the `https` protocol. - `methods` string[] — A list of HTTP methods that match this route. - `paths` string[] — A list of paths that match this route. - `preserve_host` boolean — When matching a route via one of the `hosts` domain names, use the request `Host` header in the upstream request headers. If set to `false`, the upstream `Host` header will be that of the service's `host`. - `protocols` string[] — An array of the protocols this route should allow. See the [route Object](#route-object) section for a list of accepted protocols. When set to only `https`, HTTP requests are answered with an upgrade error. When set to only `http`, HTTPS requests are answered with an error. - `regex_priority` integer — A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same `regex_priority`, the older one (lowest `created_at`) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). - `request_buffering` boolean — Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. - `response_buffering` boolean — Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. - `strip_path` boolean — When matching a route via one of the `paths`, strip the matching prefix from the upstream request URL. - `tags` string[] — An optional set of strings associated with the route for grouping and filtering. - `logging` object — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for AI Gateway logging. - `payloads` boolean - `audits` boolean - `max_request_body_size` integer — Maximum size of request body to parse. Set to 0 for unlimited. - `server` AIGatewayMCPServerServerConfigBase — **Pre-release Feature** This feature is currently in beta and is subject to change. Server-side configuration for the MCP Server. - `forward_client_headers` boolean — Whether to forward the client request headers to the upstream server when calling the tools. - `session` object — Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers. - … - `label` string — The label of the MCP server. This is used to filter the exported MCP tools. - `timeout` integer — The timeout for calling the tools in milliseconds. - `tools` AIGatewayMCPToolBase[] — List of tools exposed by this MCP Server. - `access` object - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `annotations` AIGatewayMCPToolAnnotations — **Pre-release Feature** This feature is currently in beta and is subject to change. - `destructive_hint` boolean — If true, the tool may perform destructive updates - `idempotent_hint` boolean — If true, repeated calls with same args have no additional effect - `open_world_hint` boolean — If true, tool interacts with external entities - `read_only_hint` boolean — If true, the tool does not modify its environment - `title` string — Human-readable title for the tool - `description` string, required — A description of what the tool does. - `headers` AIGatewayMCPToolHeaders — **Pre-release Feature** This feature is currently in beta and is subject to change. The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. - `host` string — The host of the exported API, which must match the route's hosts. It should be the route's host. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required. - `name` string, required — Tool identifier. In passthrough-listener mode, used to match remote MCP Server tools for ACL enforcement. In other modes, it is also used as the tool name (overrides annotations.title if present). - `method` 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT' — For conversion-only and conversion-listener modes, the method of the exported API, which must match the route's methods. - `path` string — The path of the exported API, which must match the route's paths. Path not starting with '/' are treated as relative path and the route path will be added as the prefix. By default, Kong will extract the path from API configuration. - `query` AIGatewayMCPToolQuery — **Pre-release Feature** This feature is currently in beta and is subject to change. The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. - `request_body` AIGatewayMCPToolRequestBody — **Pre-release Feature** This feature is currently in beta and is subject to change. The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported. - `responses` AIGatewayMCPToolResponses — **Pre-release Feature** This feature is currently in beta and is subject to change. The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported. - `scheme` 'http' | 'https' — The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. - `parameters` AIGatewayMCPToolParameter[] — **Pre-release Feature** This feature is currently in beta and is subject to change. - `name` string, required — The name of the parameter. - `in` 'query' | 'path' | 'header' | 'body', required — The location of the parameter in the request. - `description` string — A description of the parameter. - `required` boolean — Whether this parameter is required. - `schema` object — JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details. - `access` union — **Pre-release Feature** This feature is currently in beta and is subject to change. - AIGatewayMCPServerListenerConsumer — **Pre-release Feature** This feature is currently in beta and is subject to change. Identity provider and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. - `acl_attribute_type` 'consumer', required — The type of attributes that ACL is evaluated with. - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `identity_providers` AIGatewayIdentityProviderReference[] — List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. - `metadata` AIGatewayMCPServerProtectedResourceMetadata — **Pre-release Feature** This feature is currently in beta and is subject to change. OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised for this MCP server, allowing clients to discover the authorization servers that protect it. - … - AIGatewayMCPServerListenerOauth — **Pre-release Feature** This feature is currently in beta and is subject to change. Identity provider and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. - `acl_attribute_type` 'oauth_access_token', required — The type of attributes that ACL is evaluated with. - `access_token_claim_field` string, required — The claim in the OAuth2 access token to use as the subject for ACL evaluation when `acl_attribute_type` is set to `oauth_access_token`. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `identity_providers` AIGatewayIdentityProviderReference[] — List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. - `metadata` AIGatewayMCPServerProtectedResourceMetadata — **Pre-release Feature** This feature is currently in beta and is subject to change. OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised for this MCP server, allowing clients to discover the authorization servers that protect it. - … - `display_name` string, required — The display name for the MCP Server. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `enabled` boolean — Whether the MCP Server is enabled. - `policies` string[] — List of policy references. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `type` 'passthrough-listener', required - `config` AIGatewayMCPServerWithUpstreamConfig, required — **Pre-release Feature** This feature is currently in beta and is subject to change. Routing, logging, and server configuration for the MCP Server. - `route` AIGatewayRouteConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an AI Gateway route. - `headers` object — One or more lists of values indexed by header name that will cause this route to match if present in the request. The `Host` header cannot be used with this attribute: hosts should be specified using the `hosts` attribute. When `headers` contains only one value and that value starts with the special prefix `~*`, the value is interpreted as a regular expression. - `hosts` string[] — A list of domain names that match this route. Note that the hosts value is case sensitive. - `https_redirect_status_code` integer — The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is `HTTP` instead of `HTTPS`. `Location` header is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept the `https` protocol. - `methods` string[] — A list of HTTP methods that match this route. - `paths` string[] — A list of paths that match this route. - `preserve_host` boolean — When matching a route via one of the `hosts` domain names, use the request `Host` header in the upstream request headers. If set to `false`, the upstream `Host` header will be that of the service's `host`. - `protocols` string[] — An array of the protocols this route should allow. See the [route Object](#route-object) section for a list of accepted protocols. When set to only `https`, HTTP requests are answered with an upgrade error. When set to only `http`, HTTPS requests are answered with an error. - `regex_priority` integer — A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same `regex_priority`, the older one (lowest `created_at`) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). - `request_buffering` boolean — Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. - `response_buffering` boolean — Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. - `strip_path` boolean — When matching a route via one of the `paths`, strip the matching prefix from the upstream request URL. - `tags` string[] — An optional set of strings associated with the route for grouping and filtering. - `logging` object — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for AI Gateway logging. - `payloads` boolean - `audits` boolean - `max_request_body_size` integer — Maximum size of request body to parse. Set to 0 for unlimited. - `server` AIGatewayMCPServerServerConfigBase — **Pre-release Feature** This feature is currently in beta and is subject to change. Server-side configuration for the MCP Server. - `forward_client_headers` boolean — Whether to forward the client request headers to the upstream server when calling the tools. - `session` object — Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers. - … - `label` string — The label of the MCP server. This is used to filter the exported MCP tools. - `timeout` integer — The timeout for calling the tools in milliseconds. - `url` string, uri, required — Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} - `upstream` AIGatewayUpstreamConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration applied when proxying to the upstream service, including authentication. - `auth` AIGatewayUpstreamAuthAWS — **Pre-release Feature** This feature is currently in beta and is subject to change. AWS IAM (SigV4) authentication for the upstream service. - … - `proxy` AIGatewayProxyConfig — HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider. - `http_proxy` object — HTTP proxy server to route plaintext outbound requests through. - … - `https_proxy` object — HTTPS proxy server to route TLS outbound requests through. - … - `proxy_scheme` 'http' — The proxy scheme to use when connecting to the proxy server. - `auth` object — Credentials used to authenticate to the proxy server. - … - `no_proxy` string — Comma-separated list of hosts that should not be proxied. - `tools` AIGatewayMCPToolBase[] — List of tools exposed by this MCP Server. - `access` object - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `annotations` AIGatewayMCPToolAnnotations — **Pre-release Feature** This feature is currently in beta and is subject to change. - `destructive_hint` boolean — If true, the tool may perform destructive updates - `idempotent_hint` boolean — If true, repeated calls with same args have no additional effect - `open_world_hint` boolean — If true, tool interacts with external entities - `read_only_hint` boolean — If true, the tool does not modify its environment - `title` string — Human-readable title for the tool - `description` string, required — A description of what the tool does. - `headers` AIGatewayMCPToolHeaders — **Pre-release Feature** This feature is currently in beta and is subject to change. The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. - `host` string — The host of the exported API, which must match the route's hosts. It should be the route's host. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required. - `name` string, required — Tool identifier. In passthrough-listener mode, used to match remote MCP Server tools for ACL enforcement. In other modes, it is also used as the tool name (overrides annotations.title if present). - `method` 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT' — For conversion-only and conversion-listener modes, the method of the exported API, which must match the route's methods. - `path` string — The path of the exported API, which must match the route's paths. Path not starting with '/' are treated as relative path and the route path will be added as the prefix. By default, Kong will extract the path from API configuration. - `query` AIGatewayMCPToolQuery — **Pre-release Feature** This feature is currently in beta and is subject to change. The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. - `request_body` AIGatewayMCPToolRequestBody — **Pre-release Feature** This feature is currently in beta and is subject to change. The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported. - `responses` AIGatewayMCPToolResponses — **Pre-release Feature** This feature is currently in beta and is subject to change. The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported. - `scheme` 'http' | 'https' — The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. - `parameters` AIGatewayMCPToolParameter[] — **Pre-release Feature** This feature is currently in beta and is subject to change. - `name` string, required — The name of the parameter. - `in` 'query' | 'path' | 'header' | 'body', required — The location of the parameter in the request. - `description` string — A description of the parameter. - `required` boolean — Whether this parameter is required. - `schema` object — JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details. - `access` union — **Pre-release Feature** This feature is currently in beta and is subject to change. - AIGatewayMCPServerListenerConsumer — **Pre-release Feature** This feature is currently in beta and is subject to change. Identity provider and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. - `acl_attribute_type` 'consumer', required — The type of attributes that ACL is evaluated with. - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `identity_providers` AIGatewayIdentityProviderReference[] — List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. - `metadata` AIGatewayMCPServerProtectedResourceMetadata — **Pre-release Feature** This feature is currently in beta and is subject to change. OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised for this MCP server, allowing clients to discover the authorization servers that protect it. - … - AIGatewayMCPServerListenerOauth — **Pre-release Feature** This feature is currently in beta and is subject to change. Identity provider and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. - `acl_attribute_type` 'oauth_access_token', required — The type of attributes that ACL is evaluated with. - `access_token_claim_field` string, required — The claim in the OAuth2 access token to use as the subject for ACL evaluation when `acl_attribute_type` is set to `oauth_access_token`. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `identity_providers` AIGatewayIdentityProviderReference[] — List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. - `metadata` AIGatewayMCPServerProtectedResourceMetadata — **Pre-release Feature** This feature is currently in beta and is subject to change. OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised for this MCP server, allowing clients to discover the authorization servers that protect it. - … - `display_name` string, required — The display name for the MCP Server. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `enabled` boolean — Whether the MCP Server is enabled. - `policies` string[] — List of policy references. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `type` 'upstream-server', required - `config` AIGatewayMCPServerUpstreamServerConfig, required — **Pre-release Feature** This feature is currently in beta and is subject to change. Routing, logging, and server configuration for the MCP Server. - `route` AIGatewayRouteConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an AI Gateway route. - `headers` object — One or more lists of values indexed by header name that will cause this route to match if present in the request. The `Host` header cannot be used with this attribute: hosts should be specified using the `hosts` attribute. When `headers` contains only one value and that value starts with the special prefix `~*`, the value is interpreted as a regular expression. - `hosts` string[] — A list of domain names that match this route. Note that the hosts value is case sensitive. - `https_redirect_status_code` integer — The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is `HTTP` instead of `HTTPS`. `Location` header is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept the `https` protocol. - `methods` string[] — A list of HTTP methods that match this route. - `paths` string[] — A list of paths that match this route. - `preserve_host` boolean — When matching a route via one of the `hosts` domain names, use the request `Host` header in the upstream request headers. If set to `false`, the upstream `Host` header will be that of the service's `host`. - `protocols` string[] — An array of the protocols this route should allow. See the [route Object](#route-object) section for a list of accepted protocols. When set to only `https`, HTTP requests are answered with an upgrade error. When set to only `http`, HTTPS requests are answered with an error. - `regex_priority` integer — A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same `regex_priority`, the older one (lowest `created_at`) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). - `request_buffering` boolean — Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. - `response_buffering` boolean — Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. - `strip_path` boolean — When matching a route via one of the `paths`, strip the matching prefix from the upstream request URL. - `tags` string[] — An optional set of strings associated with the route for grouping and filtering. - `logging` object — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for AI Gateway logging. - `payloads` boolean - `audits` boolean - `max_request_body_size` integer — Maximum size of request body to parse. Set to 0 for unlimited. - `server` AIGatewayMCPServerUpstreamServerServerConfig — Server-side configuration specific to `upstream-server` mode. - `forward_client_headers` boolean — Whether to forward the client request headers to the upstream server when calling the tools. - `session` object — Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers. - … - `label` string — The label of the MCP server. This is used to filter the exported MCP tools. - `timeout` integer — The timeout for calling the tools in milliseconds. - `preserve_upstream_tool_names` boolean — If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server. If disabled (`false`), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. - `tools_list_auth` union — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an Upstream Server's MCP Server Tools' Authentication. - … - `url` string, uri, required — Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} - `upstream` AIGatewayUpstreamConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration applied when proxying to the upstream service, including authentication. - `auth` AIGatewayUpstreamAuthAWS — **Pre-release Feature** This feature is currently in beta and is subject to change. AWS IAM (SigV4) authentication for the upstream service. - … - `tools_cache_ttl_seconds` integer, required — The time-to-live (TTL) for the upstream tools cache in seconds. Set to `0` to refresh on every client call. - `tools` AIGatewayMCPUpstreamTool[] — List of tools exposed by this MCP Server. - `access` object - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `annotations` AIGatewayMCPToolAnnotations — **Pre-release Feature** This feature is currently in beta and is subject to change. - `destructive_hint` boolean — If true, the tool may perform destructive updates - `idempotent_hint` boolean — If true, repeated calls with same args have no additional effect - `open_world_hint` boolean — If true, tool interacts with external entities - `read_only_hint` boolean — If true, the tool does not modify its environment - `title` string — Human-readable title for the tool - `description` string, required — A description of what the tool does. - `headers` AIGatewayMCPToolHeaders — **Pre-release Feature** This feature is currently in beta and is subject to change. The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. - `host` string — The host of the exported API, which must match the route's hosts. It should be the route's host. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required. - `name` string, required — Tool identifier. In passthrough-listener mode, used to match remote MCP Server tools for ACL enforcement. In other modes, it is also used as the tool name (overrides annotations.title if present). - `method` 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT' — When provided, the method of the exported API, which must match the route's methods. - `path` string — The path of the exported API, which must match the route's paths. Path not starting with '/' are treated as relative path and the route path will be added as the prefix. By default, Kong will extract the path from API configuration. - `query` AIGatewayMCPToolQuery — **Pre-release Feature** This feature is currently in beta and is subject to change. The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. - `request_body` AIGatewayMCPToolRequestBody — **Pre-release Feature** This feature is currently in beta and is subject to change. The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported. - `responses` AIGatewayMCPToolResponses — **Pre-release Feature** This feature is currently in beta and is subject to change. The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported. - `scheme` 'http' | 'https' — The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. - `parameters` AIGatewayMCPToolParameter[] — **Pre-release Feature** This feature is currently in beta and is subject to change. - `name` string, required — The name of the parameter. - `in` 'query' | 'path' | 'header' | 'body', required — The location of the parameter in the request. - `description` string — A description of the parameter. - `required` boolean — Whether this parameter is required. - `schema` object — JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details. - `input_schema` object, nullable — The entire `inputSchema` section for the tool. Overrides the upstream server's `inputSchema` for the same tool name, if present. - `output_schema` object, nullable — The entire `outputSchema` section for the tool. Overrides the upstream server's `outputSchema` for the same tool name, if present. - `access` union — **Pre-release Feature** This feature is currently in beta and is subject to change. - AIGatewayMCPServerBaseACLPropertiesConsumer — **Pre-release Feature** This feature is currently in beta and is subject to change. - `acl_attribute_type` 'consumer', required — The type of attributes that ACL is evaluated with. - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - AIGatewayMCPServerBaseACLPropertiesOauth — **Pre-release Feature** This feature is currently in beta and is subject to change. - `acl_attribute_type` 'oauth_access_token', required — The type of attributes that ACL is evaluated with. - `access_token_claim_field` string, required — The claim in the OAuth2 access token to use as the subject for ACL evaluation when `acl_attribute_type` is set to `oauth_access_token`. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index - `acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `default_tool_acls` AIGatewayMCPACLs — **Pre-release Feature** This feature is currently in beta and is subject to change. Access control rules for MCP resources. Configure `allow`, `deny`, or both. - … - `display_name` string, required — The display name for the MCP Server. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `enabled` boolean — Whether the MCP Server is enabled. - `policies` string[] — List of policy references. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `meta` CursorMeta, required — Pagination metadata. - `page` CursorMetaPage, required - `first` string, path — URI to the first page - `last` string, path — URI to the last page - `next` string, path, nullable, required — URI to the next page - `previous` string, path, nullable, required — URI to the previous page - `size` number, required — Requested page size ## Other responses - `401` — Unauthorized - `403` — Forbidden - `404` — Not Found - `429` — Too Many Requests --- [API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/revisions/b1ea6bd77dec/schema)