Confluent Schema Registry with OAuth2
Use the Confluent Schema Registry for message deserialization and secure it with OAuth 2.0 token authentication.
Prerequisites
-
A Kafka cluster in Confluent Cloud.
-
A Kafka topic in the cluster.
-
An API key and secret for the cluster.
-
An identity provider that supports the OAuth 2.0 client credentials grant, such as Keycloak or Okta.
Environment variables
-
BOOTSTRAP_SERVER_HOST: The bootstrap server host. -
API_KEY: The API key to use for authentication. -
API_SECRET: The API secret to use for authentication. -
KAFKA_TOPIC: The name of the Kafka topic to consume from. -
REGISTRY_URL: The URL of your Confluent Schema Registry instance. For example,http://schema-registry:8081. -
CLIENT_ID: The client ID that the policy uses when it calls authenticated endpoints of the identity provider. -
CLIENT_SECRET: The client secret from the identity provider.
ai_gateway_policies:
- ref: schema-registry-oauth2
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: schema-registry-oauth2
display_name: Confluent Schema Registry with OAuth2
type: confluent-consume
enabled: true
config:
bootstrap_servers:
- host: !env BOOTSTRAP_SERVER_HOST
port: 9092
topics:
- name: !env KAFKA_TOPIC
mode: http-get
cluster_api_key: !env API_KEY
cluster_api_secret: !env API_SECRET
schema_registry:
confluent:
url: !env REGISTRY_URL
authentication:
mode: oauth2
oauth2:
token_endpoint: https://example.com/oauth2/token
client_id: !env CLIENT_ID
client_secret: !env CLIENT_SECRET
oauth2_client:
auth_method: client_secret_post
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "schema-registry-oauth2",
"display_name": "Confluent Schema Registry with OAuth2",
"type": "confluent-consume",
"enabled": true,
"config": {
"bootstrap_servers": [
{
"host": "'$BOOTSTRAP_SERVER_HOST'",
"port": 9092
}
],
"topics": [
{
"name": "'$KAFKA_TOPIC'"
}
],
"mode": "http-get",
"cluster_api_key": "'$API_KEY'",
"cluster_api_secret": "'$API_SECRET'",
"schema_registry": {
"confluent": {
"url": "'$REGISTRY_URL'",
"authentication": {
"mode": "oauth2",
"oauth2": {
"token_endpoint": "https://example.com/oauth2/token",
"client_id": "'$CLIENT_ID'",
"client_secret": "'$CLIENT_SECRET'"
},
"oauth2_client": {
"auth_method": "client_secret_post"
}
}
}
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "schema-registry-oauth2"
display_name = "Confluent Schema Registry with OAuth2"
type = "confluent-consume"
enabled = true
global = false
config = jsonencode({
bootstrap_servers = [
{
host = var.bootstrap_server_host
port = 9092
} ]
topics = [
{
name = var.kafka_topic
} ]
mode = "http-get"
cluster_api_key = var.api_key
cluster_api_secret = var.api_secret
schema_registry = {
confluent = {
url = var.registry_url
authentication = {
mode = "oauth2"
oauth2 = {
token_endpoint = "https://example.com/oauth2/token"
client_id = var.client_id
client_secret = var.client_secret
}
oauth2_client = {
auth_method = "client_secret_post"
}
}
}
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}ai_gateway_policies:
- ref: schema-registry-oauth2
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: schema-registry-oauth2
display_name: Confluent Schema Registry with OAuth2
type: confluent-consume
enabled: true
config:
bootstrap_servers:
- host: !env BOOTSTRAP_SERVER_HOST
port: 9092
topics:
- name: !env KAFKA_TOPIC
mode: http-get
cluster_api_key: !env API_KEY
cluster_api_secret: !env API_SECRET
schema_registry:
confluent:
url: !env REGISTRY_URL
authentication:
mode: oauth2
oauth2:
token_endpoint: https://example.com/oauth2/token
client_id: !env CLIENT_ID
client_secret: !env CLIENT_SECRET
oauth2_client:
auth_method: client_secret_post
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "schema-registry-oauth2",
"display_name": "Confluent Schema Registry with OAuth2",
"type": "confluent-consume",
"enabled": true,
"config": {
"bootstrap_servers": [
{
"host": "'$BOOTSTRAP_SERVER_HOST'",
"port": 9092
}
],
"topics": [
{
"name": "'$KAFKA_TOPIC'"
}
],
"mode": "http-get",
"cluster_api_key": "'$API_KEY'",
"cluster_api_secret": "'$API_SECRET'",
"schema_registry": {
"confluent": {
"url": "'$REGISTRY_URL'",
"authentication": {
"mode": "oauth2",
"oauth2": {
"token_endpoint": "https://example.com/oauth2/token",
"client_id": "'$CLIENT_ID'",
"client_secret": "'$CLIENT_SECRET'"
},
"oauth2_client": {
"auth_method": "client_secret_post"
}
}
}
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "schema-registry-oauth2"
display_name = "Confluent Schema Registry with OAuth2"
type = "confluent-consume"
enabled = true
global = false
config = jsonencode({
bootstrap_servers = [
{
host = var.bootstrap_server_host
port = 9092
} ]
topics = [
{
name = var.kafka_topic
} ]
mode = "http-get"
cluster_api_key = var.api_key
cluster_api_secret = var.api_secret
schema_registry = {
confluent = {
url = var.registry_url
authentication = {
mode = "oauth2"
oauth2 = {
token_endpoint = "https://example.com/oauth2/token"
client_id = var.client_id
client_secret = var.client_secret
}
oauth2_client = {
auth_method = "client_secret_post"
}
}
}
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}ai_gateway_policies:
- ref: schema-registry-oauth2
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: schema-registry-oauth2
display_name: Confluent Schema Registry with OAuth2
type: confluent-consume
enabled: true
config:
bootstrap_servers:
- host: !env BOOTSTRAP_SERVER_HOST
port: 9092
topics:
- name: !env KAFKA_TOPIC
mode: http-get
cluster_api_key: !env API_KEY
cluster_api_secret: !env API_SECRET
schema_registry:
confluent:
url: !env REGISTRY_URL
authentication:
mode: oauth2
oauth2:
token_endpoint: https://example.com/oauth2/token
client_id: !env CLIENT_ID
client_secret: !env CLIENT_SECRET
oauth2_client:
auth_method: client_secret_post
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "schema-registry-oauth2",
"display_name": "Confluent Schema Registry with OAuth2",
"type": "confluent-consume",
"enabled": true,
"config": {
"bootstrap_servers": [
{
"host": "'$BOOTSTRAP_SERVER_HOST'",
"port": 9092
}
],
"topics": [
{
"name": "'$KAFKA_TOPIC'"
}
],
"mode": "http-get",
"cluster_api_key": "'$API_KEY'",
"cluster_api_secret": "'$API_SECRET'",
"schema_registry": {
"confluent": {
"url": "'$REGISTRY_URL'",
"authentication": {
"mode": "oauth2",
"oauth2": {
"token_endpoint": "https://example.com/oauth2/token",
"client_id": "'$CLIENT_ID'",
"client_secret": "'$CLIENT_SECRET'"
},
"oauth2_client": {
"auth_method": "client_secret_post"
}
}
}
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "schema-registry-oauth2"
display_name = "Confluent Schema Registry with OAuth2"
type = "confluent-consume"
enabled = true
global = false
config = jsonencode({
bootstrap_servers = [
{
host = var.bootstrap_server_host
port = 9092
} ]
topics = [
{
name = var.kafka_topic
} ]
mode = "http-get"
cluster_api_key = var.api_key
cluster_api_secret = var.api_secret
schema_registry = {
confluent = {
url = var.registry_url
authentication = {
mode = "oauth2"
oauth2 = {
token_endpoint = "https://example.com/oauth2/token"
client_id = var.client_id
client_secret = var.client_secret
}
oauth2_client = {
auth_method = "client_secret_post"
}
}
}
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}ai_gateway_policies:
- ref: schema-registry-oauth2
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: schema-registry-oauth2
display_name: Confluent Schema Registry with OAuth2
type: confluent-consume
enabled: true
config:
bootstrap_servers:
- host: !env BOOTSTRAP_SERVER_HOST
port: 9092
topics:
- name: !env KAFKA_TOPIC
mode: http-get
cluster_api_key: !env API_KEY
cluster_api_secret: !env API_SECRET
schema_registry:
confluent:
url: !env REGISTRY_URL
authentication:
mode: oauth2
oauth2:
token_endpoint: https://example.com/oauth2/token
client_id: !env CLIENT_ID
client_secret: !env CLIENT_SECRET
oauth2_client:
auth_method: client_secret_post
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "schema-registry-oauth2",
"display_name": "Confluent Schema Registry with OAuth2",
"type": "confluent-consume",
"enabled": true,
"config": {
"bootstrap_servers": [
{
"host": "'$BOOTSTRAP_SERVER_HOST'",
"port": 9092
}
],
"topics": [
{
"name": "'$KAFKA_TOPIC'"
}
],
"mode": "http-get",
"cluster_api_key": "'$API_KEY'",
"cluster_api_secret": "'$API_SECRET'",
"schema_registry": {
"confluent": {
"url": "'$REGISTRY_URL'",
"authentication": {
"mode": "oauth2",
"oauth2": {
"token_endpoint": "https://example.com/oauth2/token",
"client_id": "'$CLIENT_ID'",
"client_secret": "'$CLIENT_SECRET'"
},
"oauth2_client": {
"auth_method": "client_secret_post"
}
}
}
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "schema-registry-oauth2"
display_name = "Confluent Schema Registry with OAuth2"
type = "confluent-consume"
enabled = true
global = false
config = jsonencode({
bootstrap_servers = [
{
host = var.bootstrap_server_host
port = 9092
} ]
topics = [
{
name = var.kafka_topic
} ]
mode = "http-get"
cluster_api_key = var.api_key
cluster_api_secret = var.api_secret
schema_registry = {
confluent = {
url = var.registry_url
authentication = {
mode = "oauth2"
oauth2 = {
token_endpoint = "https://example.com/oauth2/token"
client_id = var.client_id
client_secret = var.client_secret
}
oauth2_client = {
auth_method = "client_secret_post"
}
}
}
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}After creating the policy, add schema-registry-oauth2 to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref schema-registry-oauth2#nameAfter creating the policy, add schema-registry-oauth2 to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"schema-registry-oauth2"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add schema-registry-oauth2 to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}After creating the policy, add schema-registry-oauth2 to the policies array of your AI Agent. The tool examples update an existing AI Agent with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Agent.
ai_gateway_agents:
- ref: kongair-flight-booking-agent
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: KongAir Flight Booking Agent
name: kongair-flight-booking-agent
type: a2a
access:
acls:
allow:
- internal-teams
config:
url: https://booking-agent.internal.kongair.com
route:
paths:
- "/kongair-flight-booking"
logging:
payloads: false
max_payload_size: 1048576
policies:
- !ref schema-registry-oauth2#nameAfter creating the policy, add schema-registry-oauth2 to the policies array of your AI Agent. The tool examples update an existing AI Agent with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Agent.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/agents/kongair-flight-booking-agent \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "KongAir Flight Booking Agent",
"name": "kongair-flight-booking-agent",
"type": "a2a",
"access": {
"acls": {
"allow": [
"internal-teams"
]
}
},
"policies": [
"schema-registry-oauth2"
],
"config": {
"url": "https://booking-agent.internal.kongair.com",
"route": {
"paths": [
"/kongair-flight-booking"
]
},
"logging": {
"payloads": false,
"max_payload_size": 1048576
}
}
}
'After creating the policy, add schema-registry-oauth2 to the policies array of your AI Agent. The tool examples update an existing AI Agent with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Agent.
resource "konnect_ai_gateway_agent" "my_agent" {
display_name = "KongAir Flight Booking Agent"
name = "kongair-flight-booking-agent"
type = "a2a"
access = {
acls = {
allow = ["internal-teams"]
}
}
config = jsonencode({
url = "https://booking-agent.internal.kongair.com"
route = {
paths = ["/kongair-flight-booking"]
}
logging = {
payloads = false
max_payload_size = 1048576
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}After creating the policy, add schema-registry-oauth2 to the policies array of your AI MCP Server. The tool examples update an existing AI MCP Server with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI MCP Server.
ai_gateway_mcp_servers:
- ref: petstore-mcp
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Petstore API
name: petstore-mcp
type: conversion-listener
enabled: true
access:
acl_attribute_type: consumer
acls:
allow: []
default_tool_acls:
deny: []
config:
url: http://host.docker.internal:8080/api/v3
route:
paths:
- "/petstore"
logging:
payloads: false
server:
timeout: 60000
tools:
- name: get-pets-by-status
description: Find pets by status
method: GET
path: "/petstore/pet/findByStatus"
parameters:
- name: status
in: query
required: true
schema:
type: string
enum:
- available
- pending
- sold
description: Status value to filter pets by
- name: get-pet-by-id
description: Get pet by ID
method: GET
path: "/petstore/pet/{petId}"
parameters:
- name: petId
in: path
required: true
schema:
type: integer
description: ID of the pet to retrieve
policies:
- !ref schema-registry-oauth2#nameAfter creating the policy, add schema-registry-oauth2 to the policies array of your AI MCP Server. The tool examples update an existing AI MCP Server with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI MCP Server.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/mcp-servers/petstore-mcp \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Petstore API",
"name": "petstore-mcp",
"type": "conversion-listener",
"enabled": true,
"policies": [
"schema-registry-oauth2"
],
"access": {
"acl_attribute_type": "consumer",
"acls": {
"allow": []
},
"default_tool_acls": {
"deny": []
}
},
"config": {
"url": "http://host.docker.internal:8080/api/v3",
"route": {
"paths": [
"/petstore"
]
},
"logging": {
"payloads": false
},
"server": {
"timeout": 60000
}
},
"tools": [
{
"name": "get-pets-by-status",
"description": "Find pets by status",
"method": "GET",
"path": "/petstore/pet/findByStatus",
"parameters": [
{
"name": "status",
"in": "query",
"required": true,
"schema": {
"type": "string",
"enum": [
"available",
"pending",
"sold"
]
},
"description": "Status value to filter pets by"
}
]
},
{
"name": "get-pet-by-id",
"description": "Get pet by ID",
"method": "GET",
"path": "/petstore/pet/{petId}",
"parameters": [
{
"name": "petId",
"in": "path",
"required": true,
"schema": {
"type": "integer"
},
"description": "ID of the pet to retrieve"
}
]
}
]
}
'After creating the policy, add schema-registry-oauth2 to the policies array of your AI MCP Server. The tool examples update an existing AI MCP Server with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI MCP Server.
resource "konnect_ai_gateway_mcp_server" "my_mcp_server" {
display_name = "Petstore API"
name = "petstore-mcp"
type = "conversion-listener"
enabled = true
access = {
acl_attribute_type = "consumer"
acls = {
allow = []
}
default_tool_acls = {
deny = []
}
}
tools = [
{
name = "get-pets-by-status"
description = "Find pets by status"
method = "GET"
path = "/petstore/pet/findByStatus"
parameters = [
{
name = "status"
in = "query"
required = true
schema = {
type = "string"
enum = ["available", "pending", "sold"]
}
description = "Status value to filter pets by"
} ]
},
{
name = "get-pet-by-id"
description = "Get pet by ID"
method = "GET"
path = "/petstore/pet/{petId}"
parameters = [
{
name = "petId"
in = "path"
required = true
schema = {
type = "integer"
}
description = "ID of the pet to retrieve"
} ]
} ]
config = jsonencode({
url = "http://host.docker.internal:8080/api/v3"
route = {
paths = ["/petstore"]
}
logging = {
payloads = false
}
server = {
timeout = 60000
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}After creating the policy, add schema-registry-oauth2 to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref schema-registry-oauth2#nameAfter creating the policy, add schema-registry-oauth2 to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"schema-registry-oauth2"
]
}
'After creating the policy, add schema-registry-oauth2 to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "bootstrap_server_host" {
type = string
}
variable "api_key" {
type = string
}
variable "api_secret" {
type = string
}
variable "kafka_topic" {
type = string
}
variable "registry_url" {
type = string
}
variable "client_id" {
type = string
}
variable "client_secret" {
type = string
}