curl -X POST "$KONNECT_PROXY_URL/a2a/" \
--no-progress-meter --fail-with-body \
-H "Content-Type: application/json" \
--json '{
"jsonrpc": "2.0",
"id": "1",
"method": "message/send",
"params": {
"message": {
"kind": "message",
"messageId": "msg-001",
"role": "user",
"parts": [
{
"kind": "text",
"text": "Show me routes from SFO to JFK"
}
]
}
}
}'Limit A2A request body size
Incompatible with
on-prem
Related Documentation
Tags
Related Resources
Minimum Version
AI Gateway - 2.0
Previous Versions of this page
TL;DR
Attach a Request Size Limiting Policy to an AI Agent. Requests with a body larger than the configured limit are rejected with a 413.
Prerequisites
AI Gateway running
This is a Konnect tutorial and requires a Konnect personal access token.
-
Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
-
Export your token to an environment variable:
export KONNECT_TOKEN='YOUR_KONNECT_PAT' -
Run the AI Gateway quickstart script to automatically provision a control plane and data plane in Kong Konnect, and configure your environment:
curl -Ls https://get.konghq.com/ai | bash -s -- -k $KONNECT_TOKEN
This sets up a AI Gateway control plane named ai-quickstart, provisions a local data plane, and prints out the following environment variables export:
export AI_GATEWAY_ID=your-gateway-id
export KONNECT_TOKEN=$KONNECT_TOKEN
export KONNECT_CONTROL_PLANE_NAME=ai-quickstart
export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com
export KONNECT_PROXY_URL='http://localhost:8000'Copy and paste these into your terminal to configure your session.
kongctl v1.13.0+
This tutorial uses kongctl to manage Konnect resources programmatically. We recommend keeping kongctl up to date with the latest version (1.13.0).
- Install kongctl from developer.konghq.com/kongctl.
-
Verify the installation:
kongctl version
OpenAI API key
- Create an OpenAI account.
- Get an API key.
- Export your key:
export OPENAI_API_KEY='YOUR_OPENAI_API_KEY'
A2A agent
You need a running A2A-compliant agent. This guide uses a sample KongAir travel agent that uses OpenAI and LangGraph to answer flight route queries.
Create a docker-compose.yaml file:
cat <<'EOF' > docker-compose.yaml
services:
a2a-agent:
container_name: a2a-kongair-agent
image: ghcr.io/tomek-labuk/a2a-kongair-openai-agent:1.0.0
environment:
- OPENAI_API_KEY=${OPENAI_API_KEY}
- OPENAI_MODEL=gpt-5-mini
- KONGAIR_BASE_URL=https://api.kong-air.com
- PUBLIC_AGENT_URL=http://localhost:10000
ports:
- "10000:10000"
EOFStart the agent:
docker compose up -d --waitThe agent listens on port 10000 and uses the A2A JSON-RPC protocol to handle flight route queries. In this guide, the gateway service points to host.docker.internal:10000 instead of the container name because Kong Gateway runs in its own container with a separate DNS resolver.
Create an AI Agent and Request Size Limiting Policy
Create a Request Size Limiting Policy scoped to this Agent (global: false), and an AI Agent that attaches it via policies:. The 1 MB limit here is intentionally low to make it easy to trigger in this guide.
kongctl apply -f - --auto-approve --pat "$KONNECT_TOKEN" << 'EOF'
ai_gateway_policies:
- ref: a2a-size-limit
name: a2a-size-limit
display_name: a2a-size-limit
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
type: request-size-limiting
enabled: true
global: false
config:
allowed_payload_size: 1
size_unit: megabytes
require_content_length: false
ai_gateway_agents:
- ref: kongair-flight-booking-agent
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: "Kong Air Flight Booking Agent"
type: a2a
enabled: true
policies: [ !ref a2a-size-limit#name ]
config:
url: http://host.docker.internal:10000
route:
paths:
- /a2a
methods:
- GET
- POST
protocols:
- http
- https
strip_path: true
logging:
payloads: false
statistics: true
max_request_body_size: 8388608
EOFrequire_content_length: false means the Policy inspects the actual body size rather than relying on the Content-Length header. Set allowed_payload_size to a value appropriate for your production workload.
Validate requests within the size limit
Send a standard A2A request that falls within the 1 MB limit:
AI Gateway proxies the request to the upstream A2A agent and returns a JSON-RPC response.
Validate oversized requests are rejected
Generate a payload that exceeds 1 MB.
python3 -c "
import json
payload = {
'jsonrpc': '2.0',
'id': '2',
'method': 'message/send',
'params': {
'message': {
'kind': 'message',
'messageId': 'msg-002',
'role': 'user',
'parts': [
{
'kind': 'text',
'text': 'A' * 1100000
}
]
}
}
}
print(json.dumps(payload))
" > ./large_payload.jsonNow send it as an A2A request:
curl -i -X POST "$KONNECT_PROXY_URL/a2a" \
--no-progress-meter --fail-with-body \
-H "Content-Type: application/json" \
-F file="@large_payload.json"AI Gateway rejects the request with 413 Request Entity Too Large:
HTTP/2 413
...
{
"message": "Request size limit exceeded"
}Cleanup
Stop the A2A agent
docker compose down
docker rm -f a2a-kongair-agentClean up AI Gateway resources
To clean up all AI Gateway resources created in this guide, run:
curl -Ls https://get.konghq.com/ai | bash -s -- -dFAQs
Why limit request body size for A2A traffic?
A2A messages can carry FilePart and DataPart content alongside text. Without a size limit, a client could send arbitrarily large payloads to the upstream agent, consuming memory and bandwidth. The Request Size Limiting Policy rejects oversized requests before they reach the upstream.
Does this affect streaming responses?
No. The Request Size Limiting Policy checks the request body size, not the response. Streaming SSE responses from the upstream agent aren’t affected.
Can I scope this Policy to more than one AI Agent?
Yes. Set global: true on the Policy to apply it to every resource on your AI Gateway instead of listing it in each Agent’s policies field.