Echo response back to client
Block requests and echo the request back to the client with debugging information about the AI Gateway instance, such as the internal routing details it matched for the request.
You can also combine the config.echo parameter with a header name specified in config.trigger to make the policy trigger only on specific requests and avoid disturbing real traffic.
Because the echoed response exposes internal routing details, use a trigger and remove the policy when you finish debugging.
ai_gateway_policies:
- ref: echo-response-to-client
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: echo-response-to-client
display_name: Echo response back to client
type: request-termination
enabled: true
config:
status_code: 401
message: Error - Authentication required
echo: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "echo-response-to-client",
"display_name": "Echo response back to client",
"type": "request-termination",
"enabled": true,
"config": {
"status_code": 401,
"message": "Error - Authentication required",
"echo": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "echo-response-to-client"
display_name = "Echo response back to client"
type = "request-termination"
enabled = true
global = false
config = jsonencode({
status_code = 401
message = "Error - Authentication required"
echo = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: echo-response-to-client
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: echo-response-to-client
display_name: Echo response back to client
type: request-termination
enabled: true
config:
status_code: 401
message: Error - Authentication required
echo: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "echo-response-to-client",
"display_name": "Echo response back to client",
"type": "request-termination",
"enabled": true,
"config": {
"status_code": 401,
"message": "Error - Authentication required",
"echo": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "echo-response-to-client"
display_name = "Echo response back to client"
type = "request-termination"
enabled = true
global = false
config = jsonencode({
status_code = 401
message = "Error - Authentication required"
echo = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: echo-response-to-client
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: echo-response-to-client
display_name: Echo response back to client
type: request-termination
enabled: true
config:
status_code: 401
message: Error - Authentication required
echo: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "echo-response-to-client",
"display_name": "Echo response back to client",
"type": "request-termination",
"enabled": true,
"config": {
"status_code": 401,
"message": "Error - Authentication required",
"echo": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "echo-response-to-client"
display_name = "Echo response back to client"
type = "request-termination"
enabled = true
global = false
config = jsonencode({
status_code = 401
message = "Error - Authentication required"
echo = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: echo-response-to-client
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: echo-response-to-client
display_name: Echo response back to client
type: request-termination
enabled: true
config:
status_code: 401
message: Error - Authentication required
echo: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "echo-response-to-client",
"display_name": "Echo response back to client",
"type": "request-termination",
"enabled": true,
"config": {
"status_code": 401,
"message": "Error - Authentication required",
"echo": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "echo-response-to-client"
display_name = "Echo response back to client"
type = "request-termination"
enabled = true
global = false
config = jsonencode({
status_code = 401
message = "Error - Authentication required"
echo = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: echo-response-to-client
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: echo-response-to-client
display_name: Echo response back to client
type: request-termination
enabled: true
config:
status_code: 401
message: Error - Authentication required
echo: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "echo-response-to-client",
"display_name": "Echo response back to client",
"type": "request-termination",
"enabled": true,
"config": {
"status_code": 401,
"message": "Error - Authentication required",
"echo": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "echo-response-to-client"
display_name = "Echo response back to client"
type = "request-termination"
enabled = true
global = false
config = jsonencode({
status_code = 401
message = "Error - Authentication required"
echo = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: echo-response-to-client
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: echo-response-to-client
display_name: Echo response back to client
type: request-termination
enabled: true
config:
status_code: 401
message: Error - Authentication required
echo: true
global: trueMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "echo-response-to-client",
"display_name": "Echo response back to client",
"type": "request-termination",
"enabled": true,
"config": {
"status_code": 401,
"message": "Error - Authentication required",
"echo": true
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "echo-response-to-client"
display_name = "Echo response back to client"
type = "request-termination"
enabled = true
global = true
config = jsonencode({
status_code = 401
message = "Error - Authentication required"
echo = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add echo-response-to-client to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref echo-response-to-client#nameAfter creating the policy, add echo-response-to-client to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"echo-response-to-client"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add echo-response-to-client to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add echo-response-to-client to the policies array of your AI MCP Server. The tool examples update an existing AI MCP Server with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI MCP Server.
ai_gateway_mcp_servers:
- ref: petstore-mcp
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Petstore API
name: petstore-mcp
type: conversion-listener
enabled: true
access:
acl_attribute_type: consumer
acls:
allow: []
default_tool_acls:
deny: []
config:
url: http://host.docker.internal:8080/api/v3
route:
paths:
- "/petstore"
logging:
payloads: false
server:
timeout: 60000
tools:
- name: get-pets-by-status
description: Find pets by status
method: GET
path: "/petstore/pet/findByStatus"
parameters:
- name: status
in: query
required: true
schema:
type: string
enum:
- available
- pending
- sold
description: Status value to filter pets by
- name: get-pet-by-id
description: Get pet by ID
method: GET
path: "/petstore/pet/{petId}"
parameters:
- name: petId
in: path
required: true
schema:
type: integer
description: ID of the pet to retrieve
policies:
- !ref echo-response-to-client#nameAfter creating the policy, add echo-response-to-client to the policies array of your AI MCP Server. The tool examples update an existing AI MCP Server with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI MCP Server.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/mcp-servers/petstore-mcp \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Petstore API",
"name": "petstore-mcp",
"type": "conversion-listener",
"enabled": true,
"policies": [
"echo-response-to-client"
],
"access": {
"acl_attribute_type": "consumer",
"acls": {
"allow": []
},
"default_tool_acls": {
"deny": []
}
},
"config": {
"url": "http://host.docker.internal:8080/api/v3",
"route": {
"paths": [
"/petstore"
]
},
"logging": {
"payloads": false
},
"server": {
"timeout": 60000
}
},
"tools": [
{
"name": "get-pets-by-status",
"description": "Find pets by status",
"method": "GET",
"path": "/petstore/pet/findByStatus",
"parameters": [
{
"name": "status",
"in": "query",
"required": true,
"schema": {
"type": "string",
"enum": [
"available",
"pending",
"sold"
]
},
"description": "Status value to filter pets by"
}
]
},
{
"name": "get-pet-by-id",
"description": "Get pet by ID",
"method": "GET",
"path": "/petstore/pet/{petId}",
"parameters": [
{
"name": "petId",
"in": "path",
"required": true,
"schema": {
"type": "integer"
},
"description": "ID of the pet to retrieve"
}
]
}
]
}
'After creating the policy, add echo-response-to-client to the policies array of your AI MCP Server. The tool examples update an existing AI MCP Server with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI MCP Server.
resource "konnect_ai_gateway_mcp_server" "my_mcp_server" {
display_name = "Petstore API"
name = "petstore-mcp"
type = "conversion-listener"
enabled = true
access = {
acl_attribute_type = "consumer"
acls = {
allow = []
}
default_tool_acls = {
deny = []
}
}
tools = [
{
name = "get-pets-by-status"
description = "Find pets by status"
method = "GET"
path = "/petstore/pet/findByStatus"
parameters = [
{
name = "status"
in = "query"
required = true
schema = {
type = "string"
enum = ["available", "pending", "sold"]
}
description = "Status value to filter pets by"
} ]
},
{
name = "get-pet-by-id"
description = "Get pet by ID"
method = "GET"
path = "/petstore/pet/{petId}"
parameters = [
{
name = "petId"
in = "path"
required = true
schema = {
type = "integer"
}
description = "ID of the pet to retrieve"
} ]
} ]
config = jsonencode({
url = "http://host.docker.internal:8080/api/v3"
route = {
paths = ["/petstore"]
}
logging = {
payloads = false
}
server = {
timeout = 60000
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add echo-response-to-client to the policies array of your AI Agent. The tool examples update an existing AI Agent with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Agent.
ai_gateway_agents:
- ref: kongair-flight-booking-agent
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: KongAir Flight Booking Agent
name: kongair-flight-booking-agent
type: a2a
access:
acls:
allow:
- internal-teams
config:
url: https://booking-agent.internal.kongair.com
route:
paths:
- "/kongair-flight-booking"
logging:
payloads: false
max_payload_size: 1048576
policies:
- !ref echo-response-to-client#nameAfter creating the policy, add echo-response-to-client to the policies array of your AI Agent. The tool examples update an existing AI Agent with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Agent.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/agents/kongair-flight-booking-agent \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "KongAir Flight Booking Agent",
"name": "kongair-flight-booking-agent",
"type": "a2a",
"access": {
"acls": {
"allow": [
"internal-teams"
]
}
},
"policies": [
"echo-response-to-client"
],
"config": {
"url": "https://booking-agent.internal.kongair.com",
"route": {
"paths": [
"/kongair-flight-booking"
]
},
"logging": {
"payloads": false,
"max_payload_size": 1048576
}
}
}
'After creating the policy, add echo-response-to-client to the policies array of your AI Agent. The tool examples update an existing AI Agent with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Agent.
resource "konnect_ai_gateway_agent" "my_agent" {
display_name = "KongAir Flight Booking Agent"
name = "kongair-flight-booking-agent"
type = "a2a"
access = {
acls = {
allow = ["internal-teams"]
}
}
config = jsonencode({
url = "https://booking-agent.internal.kongair.com"
route = {
paths = ["/kongair-flight-booking"]
}
logging = {
payloads = false
max_payload_size = 1048576
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add echo-response-to-client to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref echo-response-to-client#nameAfter creating the policy, add echo-response-to-client to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"echo-response-to-client"
]
}
'After creating the policy, add echo-response-to-client to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add echo-response-to-client to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref echo-response-to-client#nameAfter creating the policy, add echo-response-to-client to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"echo-response-to-client"
]
}
'After creating the policy, add echo-response-to-client to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}