--- title: Konnect AI Gateway OpenAPI Specification description: The API for configuring AI Gateways in Konnect. url: "/api/konnect/ai-gateway/v1/" canonical_url: "/api/konnect/ai-gateway/v1/" content_type: api canonical: true --- # Konnect AI Gateway OpenAPI Specification ```yaml --- openapi: 3.0.0 info: title: Konnect AI Gateway version: 2.0.5 description: The API for configuring AI Gateways in Konnect. x-extensions-note: | Entities and properties may be annotated with `x-min-runtime-version`, the earliest AI Gateway runtime version (major and minor) that supports them. A request that sets such a property is rejected unless the AI Gateway's `min_runtime_version` is at or above the annotated value. Versions are compared by major first, then minor. A feature whose `x-min-runtime-version` is greater than `info.x-latest-public-runtime-version` is not generally available yet and will be excluded from publicly available deliverables, exactly as if it were marked `x-internal` and `x-unstable`. contact: name: Kong url: https://cloud.konghq.com x-oas-source: kong/platform-api@77e990db7b9619bacdc1556080e5b1244d78efd1 x-oas-source-link: https://github.com/Kong/platform-api/commit/77e990db7b9619bacdc1556080e5b1244d78efd1 servers: - url: https://us.api.konghq.com/v1 description: United-States Production region - url: https://eu.api.konghq.com/v1 description: Europe Production region - url: https://au.api.konghq.com/v1 description: Australia Production region - url: https://me.api.konghq.com/v1 description: Middle-East Production region - url: https://in.api.konghq.com/v1 description: India Production region - url: https://sg.api.konghq.com/v1 description: Singapore Production region paths: "/ai-gateways": get: operationId: list-ai-gateways summary: List AI Gateways description: Returns a list of AI Gateways in the organization. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageNumber" responses: '200': "$ref": "#/components/responses/ListAIGatewaysResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateways post: operationId: create-ai-gateway summary: Create an AI Gateway description: Creates a new AI Gateway in the organization. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayRequest" examples: Example Request Body: "$ref": "#/components/examples/CreateAIGatewayRequestExample" responses: '201': "$ref": "#/components/responses/CreateAIGatewayResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateways "/ai-gateways/{gatewayId}": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: get-ai-gateway summary: Get an AI Gateway description: Returns the details of a specific AI Gateway. responses: '200': "$ref": "#/components/responses/GetAIGatewayResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateways put: operationId: update-ai-gateway summary: Update an AI Gateway description: Updates the configuration of an existing AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayRequest" examples: Example Request Body: "$ref": "#/components/examples/UpdateAIGatewayRequestExample" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateways patch: operationId: patch-ai-gateway summary: Patch an AI Gateway description: Partially updates the configuration of an existing AI Gateway. Only the fields included in the request body are changed. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/PatchAIGatewayRequest" examples: Example Request Body: "$ref": "#/components/examples/PatchAIGatewayRequestExample" responses: '200': "$ref": "#/components/responses/PatchAIGatewayResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateways delete: operationId: delete-ai-gateway summary: Delete an AI Gateway description: Deletes an existing AI Gateway. responses: '204': description: AI Gateway deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateways "/ai-gateways/{gatewayId}/data-plane-certificates": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-data-plane-certificates summary: List AI Gateway DataPlane Certificates description: Returns a list of DataPlane certificates that are associated to this AI Gateway. A DataPlane certificate allows DataPlanes configured with the certificate and corresponding private key to establish connection with this AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayDataPlaneCertificatesResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway DataPlane Certificates post: operationId: create-ai-gateway-data-plane-certificate summary: Create New AI Gateway DataPlane Certificate description: Create a new DataPlane Certificate for this AI Gateway. A DataPlane certificate allows DataPlanes configured with the certificate and corresponding private key to establish connection with this AI Gateway. requestBody: content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayDataPlaneCertificateRequest" examples: Example Request Body: "$ref": "#/components/examples/AIGatewayDataplaneCertificateExample" responses: '201': "$ref": "#/components/responses/CreateAIGatewayDataPlaneCertificateResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway DataPlane Certificates "/ai-gateways/{gatewayId}/data-plane-certificates/{certificateId}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayDataPlaneCertificateId" get: operationId: get-ai-gateway-data-plane-certificate summary: Get a DataPlane Certificate description: Retrieve a DataPlane certificate associated to this AI Gateway. A DataPlane certificate allows DataPlanes configured with the certificate and corresponding private key to establish connection with this AI Gateway. responses: '200': "$ref": "#/components/responses/GetAIGatewayDataPlaneCertificateResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway DataPlane Certificates delete: operationId: delete-ai-gateway-data-plane-certificate summary: Delete AI Gateway DataPlane Certificate description: Remove a DataPlane client certificate associated to this AI Gateway. Removing a DataPlane certificate would invalidate any DataPlanes currently connected to this AI Gateway using this certificate. responses: '204': description: No Content '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway DataPlane Certificates "/ai-gateways/{gatewayId}/ca-certificates": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-ca-certificates summary: List AI Gateway CA Certificates description: Returns a list of CA certificates associated with the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayCACertificatesResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway CA Certificates post: operationId: create-ai-gateway-ca-certificate summary: Create an AI Gateway CA Certificate description: Creates a new CA certificate for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayCACertificateRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayCACertificateResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway CA Certificates "/ai-gateways/{gatewayId}/ca-certificates/{caCertificateIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayCACertificateIdOrName" get: operationId: get-ai-gateway-ca-certificate summary: Get an AI Gateway CA Certificate description: Returns the details of a specific AI Gateway CA certificate. responses: '200': "$ref": "#/components/responses/GetAIGatewayCACertificateResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway CA Certificates put: operationId: update-ai-gateway-ca-certificate summary: Update an AI Gateway CA Certificate description: Updates an existing AI Gateway CA certificate. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayCACertificateRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayCACertificateResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway CA Certificates delete: operationId: delete-ai-gateway-ca-certificate summary: Delete an AI Gateway CA Certificate description: Removes a specific AI Gateway CA certificate. responses: '204': description: CA certificate deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway CA Certificates "/ai-gateways/{gatewayId}/certificates": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-certificates summary: List AI Gateway Certificates description: Returns a list of certificates associated with the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayCertificatesResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Certificates post: operationId: create-ai-gateway-certificate summary: Create an AI Gateway Certificate description: Creates a new certificate for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayCertificateRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayCertificateResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Certificates "/ai-gateways/{gatewayId}/certificates/{certificateIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayCertificateIdOrName" get: operationId: get-ai-gateway-certificate summary: Get an AI Gateway Certificate description: Returns the details of a specific AI Gateway certificate. responses: '200': "$ref": "#/components/responses/GetAIGatewayCertificateResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Certificates put: operationId: update-ai-gateway-certificate summary: Update an AI Gateway Certificate description: Updates an existing AI Gateway certificate. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayCertificateRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayCertificateResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Certificates delete: operationId: delete-ai-gateway-certificate summary: Delete an AI Gateway Certificate description: Removes a specific AI Gateway certificate. responses: '204': description: Certificate deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Certificates "/ai-gateways/{gatewayId}/certificates/{certificateIdOrName}/snis": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayCertificateIdOrName" get: operationId: list-ai-gateway-snis-for-certificate summary: List AI Gateway SNIs for a Certificate description: Returns a list of SNIs associated with a specific AI Gateway certificate. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewaySNIsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs post: operationId: create-ai-gateway-sni-for-certificate summary: Create an AI Gateway SNI for a Certificate description: Creates a new SNI associated with a specific AI Gateway certificate. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewaySNIForCertificateRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewaySNIResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs "/ai-gateways/{gatewayId}/certificates/{certificateIdOrName}/snis/{sniIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayCertificateIdOrName" - "$ref": "#/components/parameters/AIGatewaySNIIdOrName" get: operationId: get-ai-gateway-sni-for-certificate summary: Get an AI Gateway SNI for a Certificate description: Returns the details of a specific SNI associated with an AI Gateway certificate. responses: '200': "$ref": "#/components/responses/GetAIGatewaySNIResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs put: operationId: update-ai-gateway-sni-for-certificate summary: Update an AI Gateway SNI for a Certificate description: Updates a specific SNI associated with an AI Gateway certificate. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewaySNIForCertificateRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewaySNIResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs delete: operationId: delete-ai-gateway-sni-for-certificate summary: Delete an AI Gateway SNI for a Certificate description: Removes a specific SNI associated with an AI Gateway certificate. responses: '204': description: SNI deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs "/ai-gateways/{gatewayId}/snis": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-snis summary: List AI Gateway SNIs description: Returns a list of SNIs associated with the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewaySNIsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs post: operationId: create-ai-gateway-sni summary: Create an AI Gateway SNI description: Creates a new SNI for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewaySNIRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewaySNIResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs "/ai-gateways/{gatewayId}/snis/{sniIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewaySNIIdOrName" get: operationId: get-ai-gateway-sni summary: Get an AI Gateway SNI description: Returns the details of a specific AI Gateway SNI. responses: '200': "$ref": "#/components/responses/GetAIGatewaySNIResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs put: operationId: update-ai-gateway-sni summary: Update an AI Gateway SNI description: Updates an existing AI Gateway SNI. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewaySNIRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewaySNIResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs delete: operationId: delete-ai-gateway-sni summary: Delete an AI Gateway SNI description: Removes a specific AI Gateway SNI. responses: '204': description: SNI deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway SNIs "/ai-gateways/{gatewayId}/expected-config-version": get: operationId: get-ai-gateway-expected-config-version summary: Get the Expected Config Version description: Retrieve the expected config version for this AI Gateway. The expected config version can be used to verify if the config version of a data plane node is up to date with the AI Gateway. The config version will be the same if they are in sync. responses: '200': "$ref": "#/components/responses/GetAIGatewayExpectedConfigVersionResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Nodes parameters: - "$ref": "#/components/parameters/AIGatewayId" "/ai-gateways/{gatewayId}/nodes": get: operationId: list-ai-gateway-nodes summary: List Nodes description: Returns a list of nodes associated with the specified AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayDataPlaneNodesResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Nodes parameters: - "$ref": "#/components/parameters/AIGatewayId" "/ai-gateways/{gatewayId}/nodes/{dataPlaneNodeId}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayDataPlaneNodeId" get: operationId: get-ai-gateway-node summary: Get a Node description: Returns information about a specific node associated with the AI Gateway. responses: '200': "$ref": "#/components/responses/GetAIGatewayDataPlaneNodeResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Nodes "/ai-gateways/{gatewayId}/vaults": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-vaults summary: List AI Gateway Vaults description: Returns a list of vaults associated with the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayVaultsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Vaults post: operationId: create-ai-gateway-vault summary: Create an AI Gateway Vault description: Registers a new vault for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayVaultRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayVaultResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Vaults "/ai-gateways/{gatewayId}/vaults/{vaultIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayVaultIdOrName" get: operationId: get-ai-gateway-vault summary: Get an AI Gateway Vault description: Returns the details of a specific AI Gateway vault. responses: '200': "$ref": "#/components/responses/GetAIGatewayVaultResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Vaults put: operationId: update-ai-gateway-vault summary: Update an AI Gateway Vault description: Updates the configuration of an existing AI Gateway vault. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayVaultRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayVaultResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Vaults delete: operationId: delete-ai-gateway-vault summary: Delete an AI Gateway Vault description: Removes a specific AI Gateway vault. responses: '204': description: Vault deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Vaults "/ai-gateways/{gatewayId}/policies": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-policies summary: List AI Gateway Policies description: Returns a list of policies configured for the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayPoliciesResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Policies post: operationId: create-ai-gateway-policy summary: Create an AI Gateway Policy description: Registers a new policy for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayPolicyRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayPolicyResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Policies "/ai-gateways/{gatewayId}/policies/{policyIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayPolicyIdOrName" get: operationId: get-ai-gateway-policy summary: Get an AI Gateway Policy description: Returns the details of a specific AI Gateway policy. responses: '200': "$ref": "#/components/responses/GetAIGatewayPolicyResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Policies put: operationId: update-ai-gateway-policy summary: Update an AI Gateway Policy description: Updates the configuration of an existing AI Gateway policy. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayPolicyRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayPolicyResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Policies delete: operationId: delete-ai-gateway-policy summary: Delete an AI Gateway Policy description: Removes a specific AI Gateway policy. responses: '204': description: Policy deleted successfully. '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Policies "/ai-gateways/{gatewayId}/models": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-models summary: List AI Gateway Models description: Returns a list of all models registered in the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayModelsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Models post: operationId: create-ai-gateway-model summary: Create an AI Gateway Model description: Registers a new model with routing, capabilities, and target backends. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayModelRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayModelResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Models "/ai-gateways/{gatewayId}/models/{modelIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayModelIdOrName" get: operationId: get-ai-gateway-model summary: Get an AI Gateway Model description: Returns the details of a specific AI Gateway model. responses: '200': "$ref": "#/components/responses/GetAIGatewayModelResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Models put: operationId: update-ai-gateway-model summary: Update an AI Gateway Model description: Updates the configuration of an existing AI Gateway model. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayModelRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayModelResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Models delete: operationId: delete-ai-gateway-model summary: Delete an AI Gateway Model description: Removes a specific AI Gateway model. responses: '204': description: Model deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Models "/ai-gateways/{gatewayId}/agents": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-agents summary: List AI Gateway Agents description: Returns a list of all agents registered in the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayAgentsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Agents post: operationId: create-ai-gateway-agent summary: Create an AI Gateway Agent description: Creates a new agent for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayAgentRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayAgentResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Agents "/ai-gateways/{gatewayId}/agents/{agentIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayAgentIdOrName" get: operationId: get-ai-gateway-agent summary: Get an AI Gateway Agent description: Returns the details of a specific AI Gateway agent. responses: '200': "$ref": "#/components/responses/GetAIGatewayAgentResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Agents put: operationId: update-ai-gateway-agent summary: Update an AI Gateway Agent description: Updates the configuration of an existing AI Gateway agent. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayAgentRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayAgentResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Agents delete: operationId: delete-ai-gateway-agent summary: Delete an AI Gateway Agent description: Removes a specific AI Gateway agent. responses: '204': description: Agent deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Agents "/ai-gateways/{gatewayId}/consumers": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-consumers summary: List AI Gateway Consumers description: Returns a list of all consumers for the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayConsumersResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers post: operationId: create-ai-gateway-consumer summary: Create an AI Gateway Consumer description: Creates a new consumer for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayConsumerRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayConsumerResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers "/ai-gateways/{gatewayId}/consumers/{consumerIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConsumerIdOrName" get: operationId: get-ai-gateway-consumer summary: Get an AI Gateway Consumer description: Returns the details of a specific AI Gateway consumer. responses: '200': "$ref": "#/components/responses/GetAIGatewayConsumerResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers put: operationId: update-ai-gateway-consumer summary: Update an AI Gateway Consumer description: Updates the configuration of an existing AI Gateway consumer. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayConsumerRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayConsumerResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers delete: operationId: delete-ai-gateway-consumer summary: Delete an AI Gateway Consumer description: Removes a specific AI Gateway consumer. responses: '204': description: Consumer deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers "/ai-gateways/{gatewayId}/consumers/{consumerIdOrName}/consumer-groups": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConsumerIdOrName" get: operationId: list-ai-gateway-consumer-groups-for-consumer summary: List Consumer Groups a Consumer belongs to description: List AI Gateway Consumer Groups an Consumer belongs to parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayConsumerGroupsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers put: operationId: update-ai-gateway-consumer-groups-for-consumer summary: Updates Consumer Groups a Consumer belongs to description: Updates AI Gateway Consumer Groups a Consumer belongs to requestBody: required: true content: application/json: schema: type: object properties: consumer_groups: type: array items: type: string description: Consumer Group names responses: '201': description: Consumer Group names added to the consumer content: application/json: schema: type: object properties: consumer_groups: type: array items: type: string description: Consumer Group names '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers "/ai-gateways/{gatewayId}/consumers/{consumerId}/credentials": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConsumerId" get: operationId: list-ai-gateway-consumer-credentials summary: List AI Gateway Consumer Credentials description: Returns a list of all credentials for an AI Gateway consumer. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayConsumerCredentialsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers post: operationId: create-ai-gateway-consumer-credential summary: Create an AI Gateway Consumer Credential description: Creates a new credential for an AI Gateway consumer. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayConsumerCredentialRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayConsumerCredentialResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers "/ai-gateways/{gatewayId}/consumers/{consumerId}/credentials/{credentialId}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConsumerId" - "$ref": "#/components/parameters/AIGatewayConsumerCredentialId" get: operationId: get-ai-gateway-consumer-credential summary: Get an AI Gateway Consumer Credential description: Returns the details of a specific credential for an AI Gateway consumer. responses: '200': "$ref": "#/components/responses/GetAIGatewayConsumerCredentialResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers delete: operationId: delete-ai-gateway-consumer-credential summary: Delete an AI Gateway Consumer Credential description: Removes a specific credential for an AI Gateway consumer. responses: '204': description: Credential deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumers "/ai-gateways/{gatewayId}/consumer-groups": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-consumer-groups summary: List AI Gateway Consumer Groups description: Returns a list of all consumer groups for the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayConsumerGroupsResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups post: operationId: create-ai-gateway-consumer-group summary: Create an AI Gateway Consumer Group description: Creates a new Consumer Group for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayConsumerGroupRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayConsumerGroupResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups "/ai-gateways/{gatewayId}/consumer-groups/{consumerGroupIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConsumerGroupIdOrName" get: operationId: get-ai-gateway-consumer-group summary: Get an AI Gateway Consumer Group description: Returns the details of a specific AI Gateway Consumer Group. responses: '200': "$ref": "#/components/responses/GetAIGatewayConsumerGroupResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups put: operationId: update-ai-gateway-consumer-group summary: Update an AI Gateway Consumer Group description: Updates the configuration of an existing AI Gateway Consumer Group. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayConsumerGroupRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayConsumerGroupResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups delete: operationId: delete-ai-gateway-consumer-group summary: Delete an AI Gateway Consumer Group description: Removes a specific AI Gateway Consumer Group. responses: '204': description: Consumer Group deleted successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups "/ai-gateways/{gatewayId}/consumer-groups/{consumerGroupId}/consumers": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConsumerGroupId" get: operationId: list-ai-gateway-consumers-in-consumer-group summary: List AI Gateway Consumers in a Consumer Group description: Returns a list of all consumers in the given consumer group for the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayConsumersResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups post: operationId: add-ai-gateway-consumer-to-consumer-group summary: Add a Consumer to a Consumer Group description: Add a consumer to an AI Gateway Consumer Group. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/AddAIGatewayConsumerToGroupRequest" responses: '201': "$ref": "#/components/responses/AddAIGatewayConsumerToGroupResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups "/ai-gateways/{gatewayId}/consumer-groups/{consumerGroupId}/consumers/{consumerIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConsumerGroupId" - "$ref": "#/components/parameters/AIGatewayConsumerIdOrName" delete: operationId: remove-ai-gateway-consumer-from-consumer-group summary: Remove a Consumer from a Consumer Group description: Remove a consumer from an AI Gateway Consumer Group. responses: '204': description: Consumer removed from group successfully. '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Consumer Groups "/ai-gateways/{gatewayId}/mcp-servers": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-mcp-servers summary: List MCP Servers description: Returns a list of MCP Servers configured for the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayMCPServersResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway MCP Servers post: operationId: create-ai-gateway-mcp-server summary: Create an MCP Server description: Registers a new MCP Server for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayMCPServerRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayMCPServerResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway MCP Servers "/ai-gateways/{gatewayId}/mcp-servers/{mcpServerIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayMcpServerIdOrName" get: operationId: get-ai-gateway-mcp-server summary: Get an MCP Server description: Returns the details of a specific MCP Server. responses: '200': "$ref": "#/components/responses/GetMCPServerResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway MCP Servers put: operationId: update-ai-gateway-mcp-server summary: Update an MCP Server description: Updates the configuration of an existing MCP Server. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayMCPServerRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayMCPServerResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway MCP Servers delete: operationId: delete-ai-gateway-mcp-server summary: Delete an MCP Server description: Removes a specific MCP Server from the AI Gateway. responses: '204': description: MCP Server deleted successfully. '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway MCP Servers "/ai-gateways/{gatewayId}/model-providers": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-model-providers summary: List AI Gateway Model Providers description: Returns a list of model providers configured for the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayModelProvidersResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Model Providers post: operationId: create-ai-gateway-model-provider summary: Create an AI Gateway Model Provider description: Registers a new model provider for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayModelProviderRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayModelProviderResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Model Providers "/ai-gateways/{gatewayId}/model-providers/{modelProviderIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayModelProviderIdOrName" get: operationId: get-ai-gateway-model-provider summary: Get an AI Gateway Model Provider description: Returns the details of a specific AI Gateway model provider. responses: '200': "$ref": "#/components/responses/GetAIGatewayModelProviderResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Model Providers put: operationId: update-ai-gateway-model-provider summary: Update an AI Gateway Model Provider description: Updates the configuration of an existing AI Gateway model provider. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayModelProviderRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayModelProviderResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Model Providers delete: operationId: delete-ai-gateway-model-provider summary: Delete an AI Gateway Model Provider description: Removes a specific AI Gateway model provider. responses: '204': description: Model provider deleted successfully. '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Model Providers "/ai-gateways/{gatewayId}/identity": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-identity-providers summary: List AI Gateway Identity Providers description: | Returns a list of identity providers configured for the AI Gateway. Deprecated: use `GET /ai-gateways/{gatewayId}/auth-strategies` instead. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayIdentityProvidersResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" deprecated: true tags: - AI Gateway Identity Providers post: operationId: create-ai-gateway-identity-provider summary: Create an AI Gateway Identity Provider description: | Registers a new identity provider for the AI Gateway. Deprecated: use `POST /ai-gateways/{gatewayId}/auth-strategies` instead. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayIdentityProviderRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayIdentityProviderResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" deprecated: true tags: - AI Gateway Identity Providers "/ai-gateways/{gatewayId}/identity/{identityProviderIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayIdentityProviderIdOrName" get: operationId: get-ai-gateway-identity-provider summary: Get an AI Gateway Identity Provider description: | Returns the details of a specific AI Gateway identity provider. Deprecated: use `GET /ai-gateways/{gatewayId}/auth-strategies/{authStrategyIdOrName}` instead. responses: '200': "$ref": "#/components/responses/GetAIGatewayIdentityProviderResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" deprecated: true tags: - AI Gateway Identity Providers put: operationId: update-ai-gateway-identity-provider summary: Update an AI Gateway Identity Provider description: | Updates the configuration of an existing AI Gateway Identity provider. Deprecated: use `PUT /ai-gateways/{gatewayId}/auth-strategies/{authStrategyIdOrName}` instead. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayIdentityProviderRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayIdentityProviderResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" deprecated: true tags: - AI Gateway Identity Providers delete: operationId: delete-ai-gateway-identity-provider summary: Delete an AI Gateway Identity Provider description: | Removes a specific AI Gateway Identity provider. Deprecated: use `DELETE /ai-gateways/{gatewayId}/auth-strategies/{authStrategyIdOrName}` instead. responses: '204': description: Identity provider deleted successfully. '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" deprecated: true tags: - AI Gateway Identity Providers "/ai-gateways/{gatewayId}/auth-strategies": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-auth-strategies summary: List AI Gateway Auth Strategies description: Returns a list of auth strategies configured for the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayAuthStrategiesResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Auth Strategies post: operationId: create-ai-gateway-auth-strategy summary: Create an AI Gateway Auth Strategy description: Registers a new auth strategy for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayAuthStrategyRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayAuthStrategyResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Auth Strategies "/ai-gateways/{gatewayId}/auth-strategies/{authStrategyIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayAuthStrategyIdOrName" get: operationId: get-ai-gateway-auth-strategy summary: Get an AI Gateway Auth Strategy description: Returns the details of a specific AI Gateway auth strategy. responses: '200': "$ref": "#/components/responses/GetAIGatewayAuthStrategyResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Auth Strategies put: operationId: update-ai-gateway-auth-strategy summary: Update an AI Gateway Auth Strategy description: Updates the configuration of an existing AI Gateway auth strategy. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayAuthStrategyRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayAuthStrategyResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Auth Strategies delete: operationId: delete-ai-gateway-auth-strategy summary: Delete an AI Gateway Auth Strategy description: Removes a specific AI Gateway auth strategy. responses: '204': description: Auth strategy deleted successfully. '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Auth Strategies "/ai-gateways/{gatewayId}/config-stores": parameters: - "$ref": "#/components/parameters/AIGatewayId" get: operationId: list-ai-gateway-config-stores summary: List AI Gateway Config Stores description: Returns a list of Config Stores associated with the AI Gateway. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayConfigStoresResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores post: operationId: create-ai-gateway-config-store summary: Create an AI Gateway Config Store description: Creates a new Config Store for the AI Gateway. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayConfigStoreRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayConfigStoreResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores "/ai-gateways/{gatewayId}/config-stores/{configStoreIdOrName}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConfigStoreIdOrName" get: operationId: get-ai-gateway-config-store summary: Get an AI Gateway Config Store description: Returns the details of a specific AI Gateway Config Store. responses: '200': "$ref": "#/components/responses/GetAIGatewayConfigStoreResponse" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores put: operationId: update-ai-gateway-config-store summary: Update an AI Gateway Config Store description: Updates the configuration of an existing AI Gateway Config Store. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayConfigStoreRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayConfigStoreResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores delete: operationId: delete-ai-gateway-config-store summary: Delete an AI Gateway Config Store description: Removes a specific AI Gateway Config Store. parameters: - name: force in: query description: If true, delete the Config Store and all its secrets. If false, deletion is rejected when secrets are still linked to the Config Store. schema: type: boolean default: false responses: '204': description: Config Store deleted successfully. '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores "/ai-gateways/{gatewayId}/config-stores/{configStoreIdOrName}/secrets": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConfigStoreIdOrName" get: operationId: list-ai-gateway-config-store-secrets summary: List AI Gateway Config Store Secrets description: Returns a collection of all secrets for an AI Gateway Config Store. parameters: - "$ref": "#/components/parameters/PageSize" - "$ref": "#/components/parameters/PageAfter" responses: '200': "$ref": "#/components/responses/ListAIGatewayConfigStoreSecretsResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores post: operationId: create-ai-gateway-config-store-secret summary: Create an AI Gateway Config Store Secret description: Creates a secret for an AI Gateway Config Store. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/CreateAIGatewayConfigStoreSecretRequest" responses: '201': "$ref": "#/components/responses/CreateAIGatewayConfigStoreSecretResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '409': "$ref": "#/components/responses/Conflict" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores "/ai-gateways/{gatewayId}/config-stores/{configStoreIdOrName}/secrets/{key}": parameters: - "$ref": "#/components/parameters/AIGatewayId" - "$ref": "#/components/parameters/AIGatewayConfigStoreIdOrName" - name: key in: path description: Config Store Secret key. required: true schema: "$ref": "#/components/schemas/AIGatewayConfigStoreSecretKey" get: operationId: get-ai-gateway-config-store-secret summary: Get an AI Gateway Config Store Secret description: Returns the secret entity for the Config Store. Secret values once stored cannot be retrieved. responses: '200': "$ref": "#/components/responses/GetAIGatewayConfigStoreSecretResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores put: operationId: update-ai-gateway-config-store-secret summary: Update an AI Gateway Config Store Secret description: Updates a secret for an AI Gateway Config Store. requestBody: required: true content: application/json: schema: "$ref": "#/components/schemas/UpdateAIGatewayConfigStoreSecretRequest" responses: '200': "$ref": "#/components/responses/UpdateAIGatewayConfigStoreSecretResponse" '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores delete: operationId: delete-ai-gateway-config-store-secret summary: Delete an AI Gateway Config Store Secret description: Removes a secret from an AI Gateway Config Store. responses: '204': description: Config Store Secret deleted successfully. '400': "$ref": "#/components/responses/BadRequest" '401': "$ref": "#/components/responses/Unauthorized" '403': "$ref": "#/components/responses/Forbidden" '404': "$ref": "#/components/responses/NotFound" '429': "$ref": "#/components/responses/TooManyRequests" tags: - AI Gateway Config Stores components: parameters: AIGatewayAgentIdOrName: name: agentIdOrName in: path required: true description: The unique ID or name of the AI Gateway agent. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayAuthStrategyIdOrName: name: authStrategyIdOrName in: path required: true description: The unique ID or name of the AI Gateway auth strategy. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayCACertificateIdOrName: name: caCertificateIdOrName in: path required: true description: The unique ID or name of the AI Gateway CA certificate. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayCertificateIdOrName: name: certificateIdOrName in: path required: true description: The unique ID or name of the AI Gateway certificate. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayConfigStoreIdOrName: name: configStoreIdOrName in: path required: true description: The unique ID or name of the AI Gateway Config Store. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayConsumerCredentialId: name: credentialId in: path required: true description: The unique ID of the AI Gateway consumer credential. example: bf138ba2-c9b1-4229-b268-04d9d8a6410b schema: "$ref": "#/components/schemas/UUID" AIGatewayConsumerGroupId: name: consumerGroupId in: path required: true description: The unique ID of the AI Gateway Consumer Group. example: bf138ba2-c9b1-4229-b268-04d9d8a6410b schema: "$ref": "#/components/schemas/UUID" AIGatewayConsumerGroupIdOrName: name: consumerGroupIdOrName in: path required: true description: The unique ID or name of the AI Gateway Consumer Group. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayConsumerId: name: consumerId in: path required: true description: The unique ID of the AI Gateway consumer. example: bf138ba2-c9b1-4229-b268-04d9d8a6410b schema: "$ref": "#/components/schemas/UUID" AIGatewayConsumerIdOrName: name: consumerIdOrName in: path required: true description: The unique ID or name of the AI Gateway consumer. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayDataPlaneCertificateId: name: certificateId in: path required: true description: The unique ID of the DataPlane Certificate. example: bf138ba2-c9b1-4229-b268-04d9d8a6410b schema: "$ref": "#/components/schemas/UUID" AIGatewayDataPlaneNodeId: name: dataPlaneNodeId in: path required: true description: The unique ID of the AI Gateway DataPlane Node. example: bf138ba2-c9b1-4229-b268-04d9d8a6410b schema: "$ref": "#/components/schemas/UUID" AIGatewayId: name: gatewayId in: path required: true description: The unique ID of the AI Gateway. example: bf138ba2-c9b1-4229-b268-04d9d8a6410b schema: "$ref": "#/components/schemas/UUID" AIGatewayIdentityProviderIdOrName: name: identityProviderIdOrName in: path required: true deprecated: true description: The unique ID or name of the AI Gateway Identity provider. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayMcpServerIdOrName: name: mcpServerIdOrName in: path required: true description: The unique ID or name of the MCP Server. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayModelIdOrName: name: modelIdOrName in: path required: true description: The unique ID or name of the AI Gateway model. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayModelProviderIdOrName: name: modelProviderIdOrName in: path required: true description: The unique ID or name of the AI Gateway model provider. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayPolicyIdOrName: name: policyIdOrName in: path required: true description: The unique ID or name of the AI Gateway policy. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewaySNIIdOrName: name: sniIdOrName in: path required: true description: The unique ID or name of the AI Gateway SNI. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" AIGatewayVaultIdOrName: name: vaultIdOrName in: path required: true description: The unique ID or name of the AI Gateway Vault. examples: name: value: my-entity-name summary: The name of the entity. id: value: bf138ba2-c9b1-4229-b268-04d9d8a6410b summary: The id of the entity. schema: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" PageAfter: name: page[after] description: Request the next page of data, starting with the item after this parameter. required: false in: query allowEmptyValue: true schema: type: string example: ewogICJpZCI6ICJoZWxsbyB3b3JsZCIKfQ PageNumber: name: page[number] description: Determines which page of the entities to retrieve. required: false in: query allowEmptyValue: true schema: type: integer example: 1 PageSize: name: page[size] description: The maximum number of items to include per page. The last page of a collection may include fewer items. required: false in: query allowEmptyValue: true schema: type: integer example: 10 schemas: AIGatewayEntityIdentifier: description: Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. type: string example: my-entity-name maxLength: 256 minLength: 1 pattern: "^[A-Za-z0-9._:@-]{1,256}$" AIGatewayVaultName: description: An immutable user-defined identifier for this resource. type: string example: my-awesome-vault maxLength: 255 minLength: 2 pattern: "^[a-z][a-z0-9-]*[a-z0-9]+$" AIGatewayConfigStoreName: description: An immutable user-defined identifier for this resource. type: string example: my-config-store maxLength: 255 minLength: 2 pattern: "^[a-z][a-z0-9-]*[a-z0-9]+$" AIGatewayProxyURL: description: Proxy URL associated with reaching the data-planes connected to a control-plane. type: object properties: host: description: Hostname of the proxy URL. type: string port: description: Port of the proxy URL. type: integer protocol: description: Protocol of the proxy URL. type: string example: host: example.com port: 443 protocol: https additionalProperties: false required: - host - port - protocol CreateAIGatewayRequest: type: object properties: deployment_type: description: How this AI Gateway's control plane is deployed. Set at creation time and cannot be changed afterward. type: string example: hybrid default: hybrid enum: - hybrid - managed - serverless display_name: description: The display name for this AI Gateway. type: string example: My AI Gateway maxLength: 256 minLength: 1 name: description: The name for this AI Gateway. This value is immutable after creation. type: string example: my-ai-gateway maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" description: description: The description of the AI Gateway. type: string example: An AI Gateway for my organization. maxLength: 1024 proxy_urls: description: Array of proxy URLs associated with reaching the data-planes connected to a control-plane. type: array items: "$ref": "#/components/schemas/AIGatewayProxyURL" format: set labels: "$ref": "#/components/schemas/PublicLabels" additionalProperties: false required: - display_name - name UpdateAIGatewayRequest: type: object properties: display_name: description: The display name for this AI Gateway. type: string example: My AI Gateway maxLength: 256 minLength: 1 name: description: The name for this AI Gateway. This value is immutable after creation. type: string example: my-ai-gateway maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" description: description: The description of the AI Gateway. type: string example: An AI Gateway for my organization. maxLength: 1024 proxy_urls: description: Array of proxy URLs associated with reaching the data-planes connected to a control-plane. type: array items: "$ref": "#/components/schemas/AIGatewayProxyURL" format: set labels: "$ref": "#/components/schemas/PublicLabels" additionalProperties: false required: - display_name - name PatchAIGatewayRequest: description: The request schema for partially updating an AI Gateway. type: object properties: display_name: description: The display name for this AI Gateway. type: string example: My AI Gateway maxLength: 256 minLength: 1 description: description: The description of the AI Gateway. type: string example: An AI Gateway for my organization. maxLength: 1024 proxy_urls: description: Array of proxy URLs associated with reaching the data-planes connected to a control-plane. type: array items: "$ref": "#/components/schemas/AIGatewayProxyURL" format: set labels: "$ref": "#/components/schemas/PublicLabels" additionalProperties: false title: PatchAIGatewayRequest AIGateway: type: object properties: display_name: description: The display name for this AI Gateway. type: string example: My AI Gateway maxLength: 256 minLength: 1 name: description: The name for this AI Gateway. This value is immutable after creation. type: string example: my-ai-gateway maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" description: description: The description of the AI Gateway. type: string example: An AI Gateway for my organization. maxLength: 1024 proxy_urls: description: Array of proxy URLs associated with reaching the data-planes connected to a control-plane. type: array items: "$ref": "#/components/schemas/AIGatewayProxyURL" format: set labels: "$ref": "#/components/schemas/PublicLabels" id: "$ref": "#/components/schemas/UUID" deployment_type: description: How this AI Gateway's control plane is deployed. type: string example: hybrid default: hybrid enum: - hybrid - managed - serverless readOnly: true endpoints: description: Object containing AI Gateway access endpoints. type: object additionalProperties: false properties: configuration: description: Configuration Endpoint. type: string format: url example: https://acfe5f253f.cp.konghq.com readOnly: true telemetry: description: Telemetry Endpoint. type: string format: url example: https://acfe5f253f.tp0.konghq.com readOnly: true required: - configuration - telemetry config_version: description: | The version identification of the latest configuration of the gateway. Any change to an entity under this gateway can result in a new version. The config_version is generated in the control plane and used to verify if an AI Gateway node configuration is up to date. type: string readOnly: true created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" required: - display_name - name - id - endpoints - created_at - updated_at - deployment_type CreateAIGatewayCACertificateRequest: description: A CA certificate represents a trusted CA. These objects are used to verify the validity of a client or server certificate. type: object properties: name: description: A user-defined unique identifier for this CA certificate, used as a stable human-readable reference. This value is immutable after creation. example: my-root-ca allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" cert: description: PEM-encoded public certificate of the CA. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- x-referenceable: true cert_digest: description: SHA256 hex digest of the public certificate. This field is read-only and is automatically computed; it cannot be set by the caller. type: string nullable: true readOnly: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - name - cert UpdateAIGatewayCACertificateRequest: description: A CA certificate represents a trusted CA. These objects are used to verify the validity of a client or server certificate. type: object properties: name: description: A user-defined unique identifier for this CA certificate, used as a stable human-readable reference. This value is immutable after creation. example: my-root-ca allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" cert: description: PEM-encoded public certificate of the CA. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- x-referenceable: true cert_digest: description: SHA256 hex digest of the public certificate. This field is read-only and is automatically computed; it cannot be set by the caller. type: string nullable: true readOnly: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - name - cert AIGatewayCACertificate: description: A CA certificate represents a trusted CA. These objects are used to verify the validity of a client or server certificate. type: object properties: name: description: A user-defined unique identifier for this CA certificate, used as a stable human-readable reference. This value is immutable after creation. example: my-root-ca allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" cert: description: PEM-encoded public certificate of the CA. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- x-referenceable: true cert_digest: description: SHA256 hex digest of the public certificate. This field is read-only and is automatically computed; it cannot be set by the caller. type: string nullable: true readOnly: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - name - cert - id - created_at - updated_at CreateAIGatewayCertificateRequest: description: A certificate holds a PEM-encoded certificate and its matching private key, used to terminate or originate TLS connections. type: object properties: name: description: A user-defined unique identifier for this certificate, used as a stable human-readable reference. This value is immutable after creation. example: my-tls-cert allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" cert: description: PEM-encoded public certificate chain. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- x-referenceable: true key: description: PEM-encoded private key matching `cert`. type: string example: | -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- writeOnly: true x-referenceable: true cert_alt: description: PEM-encoded public certificate chain of the alternative certificate. It must use a different key algorithm than `cert`, and requires `key_alt` to be set. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- nullable: true x-referenceable: true key_alt: description: PEM-encoded private key matching `cert_alt`. Requires `cert_alt` to be set. type: string example: | -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- nullable: true writeOnly: true x-referenceable: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - name - cert - key UpdateAIGatewayCertificateRequest: description: A certificate holds a PEM-encoded certificate and its matching private key, used to terminate or originate TLS connections. type: object properties: name: description: A user-defined unique identifier for this certificate, used as a stable human-readable reference. This value is immutable after creation. example: my-tls-cert allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" cert: description: PEM-encoded public certificate chain. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- x-referenceable: true key: description: PEM-encoded private key matching `cert`. type: string example: | -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- writeOnly: true x-referenceable: true cert_alt: description: PEM-encoded public certificate chain of the alternative certificate. It must use a different key algorithm than `cert`, and requires `key_alt` to be set. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- nullable: true x-referenceable: true key_alt: description: PEM-encoded private key matching `cert_alt`. Requires `cert_alt` to be set. type: string example: | -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- nullable: true writeOnly: true x-referenceable: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - name - cert - key AIGatewayCertificate: description: A certificate holds a PEM-encoded certificate and its matching private key, used to terminate or originate TLS connections. type: object properties: name: description: A user-defined unique identifier for this certificate, used as a stable human-readable reference. This value is immutable after creation. example: my-tls-cert allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" cert: description: PEM-encoded public certificate chain. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- x-referenceable: true key: description: PEM-encoded private key matching `cert`. type: string example: | -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- writeOnly: true x-referenceable: true cert_alt: description: PEM-encoded public certificate chain of the alternative certificate. It must use a different key algorithm than `cert`, and requires `key_alt` to be set. type: string example: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- nullable: true x-referenceable: true key_alt: description: PEM-encoded private key matching `cert_alt`. Requires `cert_alt` to be set. type: string example: | -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- nullable: true writeOnly: true x-referenceable: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - name - cert - key - id - created_at - updated_at AIGatewaySNICertificateReference: description: A reference to the certificate with which to associate the SNI hostname, by certificate name. The certificate must have a valid private key to be used by the SNI. type: string example: my-certificate AIGatewayHostname: description: A hostname used for TLS Server Name Indication (SNI) matching. Supports an optional wildcard segment at either end of the hostname (for example `*.example.com` or `example.*`). type: string example: example.org anyOf: - pattern: "^(\\*\\.)?[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?)*(\\.)?$" - pattern: "^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?)*(\\.)?(\\.\\*)?$" CreateAIGatewaySNIRequest: description: An SNI represents a many-to-one mapping of hostnames to a certificate. A certificate can have many hostnames associated with it; when the AI Gateway receives an SSL request, it uses the SNI field in the Client Hello to look up the certificate associated with the SNI. type: object properties: name: description: The name for this SNI. This value is immutable after creation. type: string example: my-sni maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" display_name: description: The display name for this SNI. type: string example: My SNI maxLength: 256 minLength: 1 hostname: "$ref": "#/components/schemas/AIGatewayHostname" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" certificate: "$ref": "#/components/schemas/AIGatewaySNICertificateReference" additionalProperties: false required: - name - display_name - hostname - certificate UpdateAIGatewaySNIRequest: description: An SNI represents a many-to-one mapping of hostnames to a certificate. A certificate can have many hostnames associated with it; when the AI Gateway receives an SSL request, it uses the SNI field in the Client Hello to look up the certificate associated with the SNI. type: object properties: name: description: The name for this SNI. This value is immutable after creation. type: string example: my-sni maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" display_name: description: The display name for this SNI. type: string example: My SNI maxLength: 256 minLength: 1 hostname: "$ref": "#/components/schemas/AIGatewayHostname" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" certificate: "$ref": "#/components/schemas/AIGatewaySNICertificateReference" additionalProperties: false required: - name - display_name - hostname - certificate CreateAIGatewaySNIForCertificateRequest: description: An SNI represents a many-to-one mapping of hostnames to a certificate. A certificate can have many hostnames associated with it; when the AI Gateway receives an SSL request, it uses the SNI field in the Client Hello to look up the certificate associated with the SNI. type: object properties: name: description: The name for this SNI. This value is immutable after creation. type: string example: my-sni maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" display_name: description: The display name for this SNI. type: string example: My SNI maxLength: 256 minLength: 1 hostname: "$ref": "#/components/schemas/AIGatewayHostname" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - name - display_name - hostname UpdateAIGatewaySNIForCertificateRequest: description: An SNI represents a many-to-one mapping of hostnames to a certificate. A certificate can have many hostnames associated with it; when the AI Gateway receives an SSL request, it uses the SNI field in the Client Hello to look up the certificate associated with the SNI. type: object properties: name: description: The name for this SNI. This value is immutable after creation. type: string example: my-sni maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" display_name: description: The display name for this SNI. type: string example: My SNI maxLength: 256 minLength: 1 hostname: "$ref": "#/components/schemas/AIGatewayHostname" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - name - display_name - hostname AIGatewaySNI: description: An SNI represents a many-to-one mapping of hostnames to a certificate. A certificate can have many hostnames associated with it; when the AI Gateway receives an SSL request, it uses the SNI field in the Client Hello to look up the certificate associated with the SNI. type: object properties: name: description: The name for this SNI. This value is immutable after creation. type: string example: my-sni maxLength: 256 minLength: 1 pattern: "^[0-9a-z-]+$" display_name: description: The display name for this SNI. type: string example: My SNI maxLength: 256 minLength: 1 hostname: "$ref": "#/components/schemas/AIGatewayHostname" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" certificate: "$ref": "#/components/schemas/AIGatewaySNICertificateReference" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - name - display_name - hostname - certificate - id - created_at - updated_at CreateAIGatewayDataPlaneCertificateRequest: type: object properties: cert: description: JSON escaped string of the certificate. type: string title: description: A human-readable name for the certificate. type: string maxLength: 256 minLength: 1 description: description: An optional description of the certificate. type: string maxLength: 1024 additionalProperties: false required: - cert - title AIGatewayDataPlaneClientCertificate: type: object properties: cert: description: JSON escaped string of the certificate. type: string title: description: A human-readable name for the certificate. type: string maxLength: 256 minLength: 1 description: description: An optional description of the certificate. type: string maxLength: 1024 id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" metadata: description: Metadata extracted from the certificate. type: object additionalProperties: false properties: subject: description: The certificate subject. type: string issuer: description: The certificate issuer. type: string san_names: description: Subject alternative names (deprecated). type: array items: type: string deprecated: true expiry: description: Unix timestamp of certificate expiry. type: integer format: int64 key_usages: description: Key usage types for the certificate. type: array items: type: string snis: description: Server Name Indications associated with the certificate. type: array items: type: string dns_names: description: DNS subject alternative names. type: array items: type: string email_addresses: description: Email subject alternative names. type: array items: type: string ip_addresses: description: IP subject alternative names. type: array items: type: string uris: description: URI subject alternative names. type: array items: type: string is_ca: description: Whether the certificate is a CA certificate. type: boolean readOnly: true additionalProperties: false required: - cert - title - id - created_at - updated_at AIGatewayDataPlaneNode: type: object properties: id: "$ref": "#/components/schemas/UUID" version: type: string hostname: type: string last_ping: type: integer type: type: string created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" config_version: description: The version of the configuration applied by the node. type: string readOnly: true errors: description: Validation or configuration errors reported by the data plane node. type: array items: "$ref": "#/components/schemas/AIGatewayDataPlaneNodeError" compatibility_status: type: object additionalProperties: false properties: state: type: string issues: type: array items: "$ref": "#/components/schemas/AIGatewayDataPlaneNodeCompatibilityIssue" labels: "$ref": "#/components/schemas/PublicLabels" additionalProperties: false required: - id - version - hostname - last_ping - type - created_at - updated_at - compatibility_status AIGatewayDataPlaneNodeError: type: object properties: name: type: string error_message: type: string config_hash: type: string flattened_errors: type: array items: "$ref": "#/components/schemas/AIGatewayDataPlaneNodeFlattenedError" fields: type: object additionalProperties: type: string code: type: integer source: type: string traceback: type: string additionalProperties: false required: - name - error_message - code - source - traceback title: A Node Error AIGatewayDataPlaneNodeFlattenedError: type: object properties: entity_id: type: string entity_name: type: string entity_type: type: string errors: type: array items: "$ref": "#/components/schemas/AIGatewayDataPlaneNodeErrorDetail" additionalProperties: false AIGatewayDataPlaneNodeErrorDetail: type: object properties: error_message: type: string type: type: string field: type: string additionalProperties: false AIGatewayExpectedConfigVersion: type: object properties: expected_config_version: description: The expected configuration version. type: string created_at: "$ref": "#/components/schemas/CreatedAt" required: - expected_config_version AIGatewayDataPlaneNodeCompatibilityIssue: type: object properties: code: description: The compatibility issue code. type: string severity: description: The severity of the issue. type: string description: description: The description of the issue. type: string resolution: description: Steps required to take in order to resolve the issue. type: string affected_resources: description: Details of the resources affected by the issue. type: array items: "$ref": "#/components/schemas/AIGatewayDataPlaneNodeCompatibilityIssueAffectedResource" documentation_url: description: Doc URL for the compatibility issue. type: string additionalProperties: false required: - code - severity - description - resolution - affected_resources - documentation_url AIGatewayDataPlaneNodeCompatibilityIssueAffectedResource: type: object properties: id: description: ID of the affected resource. type: string type: description: Type of the affected resource. type: string parent_code: description: Parent Issue Code. type: string details: description: Details of the affected resource. type: array items: type: string additionalProperties: false required: - id - type - parent_code - details AIGatewayModelModel: description: Configuration for proxying synchronous requests/responses to/from an AI Gateway model using generative APIs. type: object properties: display_name: description: The display name for this model instance. type: string example: My GPT 5 model maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model, used as a stable human-readable reference. This value is immutable after creation. example: my-gpt-5-model allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the model is enabled. type: boolean example: true default: true access: "$ref": "#/components/schemas/AIGatewayModelAccess" formats: description: List of request/response formats supported by this model. type: array items: "$ref": "#/components/schemas/AIGatewayModelFormat" maxItems: 1 minItems: 1 targets: description: One or more backend models that this model entry routes to. type: array items: "$ref": "#/components/schemas/AIGatewayTarget" minItems: 1 policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - model x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayModelModelConfig" capabilities: description: List of AI capabilities enabled for this model. type: array items: type: string enum: - generate - agentic - realtime - embeddings - image - audio/speech - audio/transcription - audio/translation - video - rerank minItems: 1 required: - display_name - name - formats - targets - type - config - capabilities AIGatewayModelAPI: description: Configuration for proxying asynchronous requests/responses to/from an AI Gateway model using the files and batches APIs. type: object properties: display_name: description: The display name for this model instance. type: string example: My GPT 5 model maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model, used as a stable human-readable reference. This value is immutable after creation. example: my-gpt-5-model allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the model is enabled. type: boolean example: true default: true access: "$ref": "#/components/schemas/AIGatewayModelAccess" formats: description: List of request/response formats supported by this model. type: array items: "$ref": "#/components/schemas/AIGatewayModelFormat" maxItems: 1 minItems: 1 targets: description: One or more backend models that this model entry routes to. type: array items: "$ref": "#/components/schemas/AIGatewayTarget" minItems: 1 policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - api x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayModelAPIConfig" capabilities: description: List of AI capabilities enabled for this API model. type: array items: type: string enum: - batches - files required: - display_name - name - formats - targets - type - config - capabilities CreateAIGatewayModelRequest: description: Configuration for an AI Gateway model. discriminator: propertyName: type mapping: api: "#/components/schemas/AIGatewayModelAPI" model: "#/components/schemas/AIGatewayModelModel" oneOf: - "$ref": "#/components/schemas/AIGatewayModelAPI" - "$ref": "#/components/schemas/AIGatewayModelModel" UpdateAIGatewayModelRequest: description: Configuration for an AI Gateway model. discriminator: propertyName: type mapping: api: "#/components/schemas/AIGatewayModelAPI" model: "#/components/schemas/AIGatewayModelModel" oneOf: - "$ref": "#/components/schemas/AIGatewayModelAPI" - "$ref": "#/components/schemas/AIGatewayModelModel" AIGatewayModel: description: Configuration for an AI Gateway model. type: object properties: id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" discriminator: propertyName: type mapping: api: "#/components/schemas/AIGatewayModelAPI" model: "#/components/schemas/AIGatewayModelModel" oneOf: - "$ref": "#/components/schemas/AIGatewayModelAPI" - "$ref": "#/components/schemas/AIGatewayModelModel" required: - id - created_at - updated_at AIGatewayModelModelConfig: description: Routing, logging, and load balancing configuration for the model. type: object properties: route: "$ref": "#/components/schemas/AIGatewayModelRouteConfig" logging: "$ref": "#/components/schemas/AIGatewayLoggingConfig" response_streaming: type: string default: allow enum: - allow - always - deny max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 model: type: object default: name_header: true additionalProperties: false properties: name_header: description: Display the model name selected in the X-Kong-LLM-Model response header type: boolean default: true balancer: "$ref": "#/components/schemas/AIGatewayModelBalancerConfig" proxy: "$ref": "#/components/schemas/AIGatewayProxyConfig" additionalProperties: false required: - route AIGatewayModelAPIConfig: description: Routing, logging, and load balancing configuration for the model. type: object properties: route: "$ref": "#/components/schemas/AIGatewayModelRouteConfig" logging: "$ref": "#/components/schemas/AIGatewayLoggingConfig" response_streaming: type: string default: allow enum: - allow - always - deny max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 balancer: "$ref": "#/components/schemas/AIGatewayModelBalancerConfig" proxy: "$ref": "#/components/schemas/AIGatewayProxyConfig" additionalProperties: false required: - route AIGatewayModelRouteConfig: description: Configuration for an AI Gateway route. type: object properties: headers: description: 'One or more lists of values indexed by header name that will cause this route to match if present in the request. The `Host` header cannot be used with this attribute: hosts should be specified using the `hosts` attribute. When `headers` contains only one value and that value starts with the special prefix `~*`, the value is interpreted as a regular expression.' type: object example: version: - v1 - v2 additionalProperties: true hosts: description: A list of domain names that match this route. Note that the hosts value is case sensitive. type: array items: type: string example: foo.example.com https_redirect_status_code: description: 'The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is `HTTP` instead of `HTTPS`. `Location` header is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept the `https` protocol.' type: integer default: 426 maximum: 599 minimum: 100 methods: description: A list of HTTP methods that match this route. type: array items: type: string paths: description: A list of paths that match this route. type: array items: type: string preserve_host: description: When matching a route via one of the `hosts` domain names, use the request `Host` header in the upstream request headers. If set to `false`, the upstream `Host` header will be that of the service's `host`. type: boolean default: false protocols: description: An array of the protocols this route should allow. See the [route Object](#route-object) section for a list of accepted protocols. When set to only `https`, HTTP requests are answered with an upgrade error. When set to only `http`, HTTPS requests are answered with an error. type: array items: type: string default: - http - https regex_priority: description: A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same `regex_priority`, the older one (lowest `created_at`) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). type: integer default: 0 maximum: 2147483647 minimum: -2147483648 request_buffering: description: Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. type: boolean default: true response_buffering: description: Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. type: boolean default: true strip_path: description: When matching a route via one of the `paths`, strip the matching prefix from the upstream request URL. type: boolean default: true tags: description: An optional set of strings associated with the route for grouping and filtering. type: array items: type: string model: "$ref": "#/components/schemas/AIGatewayModelSelectorConfig" additionalProperties: false AIGatewayModelSelectorConfig: description: | Configuration for overriding routing to this model using a selector. When no selector location is set, the format default selector is used. When values are not set, the model name is used as the selector value. type: object properties: body_param: description: The body property name to match for routing. type: string example: model minLength: 1 header_param: description: The header property name to match for routing. type: string example: x-model minLength: 1 path_param: description: 'The name of the regex capture group defined in the route path for routing. ' type: string example: model_name minLength: 1 values: description: | An optional model alias. When omitted, the model name is used. When no selector location is configured, the format default selector is used. type: array items: type: string minLength: 1 maxItems: 1 minItems: 1 additionalProperties: false title: AIGatewayModelSelectorConfig AIGatewayModelBalancerConfig: description: Configuration for a model's load balancer when multiple target models are configured. discriminator: propertyName: algorithm mapping: consistent-hashing: "#/components/schemas/AIGatewayModelBalancerConsistentHashingConfig" least-connections: "#/components/schemas/AIGatewayModelBalancerLeastConnectionsConfig" lowest-latency: "#/components/schemas/AIGatewayModelBalancerLowestLatencyConfig" lowest-usage: "#/components/schemas/AIGatewayModelBalancerLowestUsageConfig" priority: "#/components/schemas/AIGatewayModelBalancerPriorityConfig" round-robin: "#/components/schemas/AIGatewayModelBalancerRoundRobinConfig" semantic: "#/components/schemas/AIGatewayModelBalancerSemanticConfig" oneOf: - "$ref": "#/components/schemas/AIGatewayModelBalancerConsistentHashingConfig" - "$ref": "#/components/schemas/AIGatewayModelBalancerLeastConnectionsConfig" - "$ref": "#/components/schemas/AIGatewayModelBalancerLowestLatencyConfig" - "$ref": "#/components/schemas/AIGatewayModelBalancerLowestUsageConfig" - "$ref": "#/components/schemas/AIGatewayModelBalancerPriorityConfig" - "$ref": "#/components/schemas/AIGatewayModelBalancerRoundRobinConfig" - "$ref": "#/components/schemas/AIGatewayModelBalancerSemanticConfig" AIGatewayModelBalancerConsistentHashingConfig: type: object properties: connect_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 fail_timeout: description: The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`. type: integer default: 10000 maximum: 2147483646 minimum: 1 failover_criteria: description: Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream type: array items: type: string enum: - error - http_403 - http_404 - http_429 - http_500 - http_502 - http_503 - http_504 - invalid_header - non_idempotent - timeout default: - error - timeout max_fails: description: Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts. type: integer default: 0 maximum: 32767 minimum: 0 read_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 retries: description: The number of retries to execute upon failure to proxy. type: integer default: 5 maximum: 32767 minimum: 0 slots: description: The number of slots in the load balancer algorithm. type: integer default: 10000 maximum: 65536 minimum: 10 write_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 algorithm: type: string enum: - consistent-hashing x-terraform-transform-const: true hash_on_header: description: The header to use for consistent-hashing. type: string default: X-Kong-LLM-Request-ID additionalProperties: false required: - algorithm AIGatewayModelBalancerLeastConnectionsConfig: type: object properties: connect_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 fail_timeout: description: The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`. type: integer default: 10000 maximum: 2147483646 minimum: 1 failover_criteria: description: Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream type: array items: type: string enum: - error - http_403 - http_404 - http_429 - http_500 - http_502 - http_503 - http_504 - invalid_header - non_idempotent - timeout default: - error - timeout max_fails: description: Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts. type: integer default: 0 maximum: 32767 minimum: 0 read_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 retries: description: The number of retries to execute upon failure to proxy. type: integer default: 5 maximum: 32767 minimum: 0 slots: description: The number of slots in the load balancer algorithm. type: integer default: 10000 maximum: 65536 minimum: 10 write_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 algorithm: type: string enum: - least-connections x-terraform-transform-const: true additionalProperties: false required: - algorithm AIGatewayModelBalancerLowestLatencyConfig: type: object properties: connect_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 fail_timeout: description: The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`. type: integer default: 10000 maximum: 2147483646 minimum: 1 failover_criteria: description: Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream type: array items: type: string enum: - error - http_403 - http_404 - http_429 - http_500 - http_502 - http_503 - http_504 - invalid_header - non_idempotent - timeout default: - error - timeout max_fails: description: Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts. type: integer default: 0 maximum: 32767 minimum: 0 read_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 retries: description: The number of retries to execute upon failure to proxy. type: integer default: 5 maximum: 32767 minimum: 0 slots: description: The number of slots in the load balancer algorithm. type: integer default: 10000 maximum: 65536 minimum: 10 write_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 algorithm: type: string enum: - lowest-latency x-terraform-transform-const: true latency_strategy: description: 'What metrics to use for latency. Available values are: `tpot` (time-per-output-token) and `e2e`.' type: string default: tpot enum: - e2e - tpot additionalProperties: false required: - algorithm - latency_strategy AIGatewayModelBalancerLowestUsageConfig: type: object properties: connect_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 fail_timeout: description: The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`. type: integer default: 10000 maximum: 2147483646 minimum: 1 failover_criteria: description: Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream type: array items: type: string enum: - error - http_403 - http_404 - http_429 - http_500 - http_502 - http_503 - http_504 - invalid_header - non_idempotent - timeout default: - error - timeout max_fails: description: Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts. type: integer default: 0 maximum: 32767 minimum: 0 read_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 retries: description: The number of retries to execute upon failure to proxy. type: integer default: 5 maximum: 32767 minimum: 0 slots: description: The number of slots in the load balancer algorithm. type: integer default: 10000 maximum: 65536 minimum: 10 write_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 algorithm: type: string enum: - lowest-usage x-terraform-transform-const: true tokens_count_strategy: description: Methodology to use for token usage calculation. type: string default: total-tokens enum: - completion-tokens - cost - llm-accuracy - prompt-tokens - total-tokens additionalProperties: false required: - algorithm - tokens_count_strategy AIGatewayModelBalancerPriorityConfig: type: object properties: connect_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 fail_timeout: description: The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`. type: integer default: 10000 maximum: 2147483646 minimum: 1 failover_criteria: description: Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream type: array items: type: string enum: - error - http_403 - http_404 - http_429 - http_500 - http_502 - http_503 - http_504 - invalid_header - non_idempotent - timeout default: - error - timeout max_fails: description: Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts. type: integer default: 0 maximum: 32767 minimum: 0 read_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 retries: description: The number of retries to execute upon failure to proxy. type: integer default: 5 maximum: 32767 minimum: 0 slots: description: The number of slots in the load balancer algorithm. type: integer default: 10000 maximum: 65536 minimum: 10 write_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 algorithm: type: string enum: - priority x-terraform-transform-const: true additionalProperties: false required: - algorithm AIGatewayModelBalancerRoundRobinConfig: type: object properties: connect_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 fail_timeout: description: The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`. type: integer default: 10000 maximum: 2147483646 minimum: 1 failover_criteria: description: Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream type: array items: type: string enum: - error - http_403 - http_404 - http_429 - http_500 - http_502 - http_503 - http_504 - invalid_header - non_idempotent - timeout default: - error - timeout max_fails: description: Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts. type: integer default: 0 maximum: 32767 minimum: 0 read_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 retries: description: The number of retries to execute upon failure to proxy. type: integer default: 5 maximum: 32767 minimum: 0 slots: description: The number of slots in the load balancer algorithm. type: integer default: 10000 maximum: 65536 minimum: 10 write_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 algorithm: type: string enum: - round-robin x-terraform-transform-const: true additionalProperties: false required: - algorithm AIGatewayModelBalancerSemanticConfig: type: object properties: connect_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 fail_timeout: description: The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`. type: integer default: 10000 maximum: 2147483646 minimum: 1 failover_criteria: description: Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream type: array items: type: string enum: - error - http_403 - http_404 - http_429 - http_500 - http_502 - http_503 - http_504 - invalid_header - non_idempotent - timeout default: - error - timeout max_fails: description: Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts. type: integer default: 0 maximum: 32767 minimum: 0 read_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 retries: description: The number of retries to execute upon failure to proxy. type: integer default: 5 maximum: 32767 minimum: 0 slots: description: The number of slots in the load balancer algorithm. type: integer default: 10000 maximum: 65536 minimum: 10 write_timeout: type: integer default: 60000 maximum: 2147483646 minimum: 1 algorithm: type: string enum: - semantic x-terraform-transform-const: true embeddings: description: Embeddings model configuration for this model. type: object additionalProperties: false properties: allow_auth_override: description: 'When enabled, request-level auth parameters (such as API keys or bearer tokens) will override the static values defined for the provider. ' type: boolean default: false provider: "$ref": "#/components/schemas/AIGatewayModelProviderReference" name: description: The name of the embeddings model. type: string config: "$ref": "#/components/schemas/AIGatewayEmbeddingsModelConfig" required: - name - provider - config vectordb: "$ref": "#/components/schemas/AIGatewayModelVectorDBConfig" additionalProperties: false required: - algorithm - embeddings - vectordb AIGatewayEmbeddingsModelConfig: description: Configuration for an embeddings model. discriminator: propertyName: type mapping: azure: "#/components/schemas/AIGatewayAzureEmbeddingsModelConfig" bedrock: "#/components/schemas/AIGatewayBedrockEmbeddingsModelConfig" gemini: "#/components/schemas/AIGatewayGeminiEmbeddingsModelConfig" huggingface: "#/components/schemas/AIGatewayHuggingfaceEmbeddingsModelConfig" mistral: "#/components/schemas/AIGatewayMistralEmbeddingsModelConfig" ollama: "#/components/schemas/AIGatewayOllamaEmbeddingsModelConfig" openai: "#/components/schemas/AIGatewayOpenaiEmbeddingsModelConfig" oneOf: - "$ref": "#/components/schemas/AIGatewayAzureEmbeddingsModelConfig" - "$ref": "#/components/schemas/AIGatewayBedrockEmbeddingsModelConfig" - "$ref": "#/components/schemas/AIGatewayGeminiEmbeddingsModelConfig" - "$ref": "#/components/schemas/AIGatewayHuggingfaceEmbeddingsModelConfig" - "$ref": "#/components/schemas/AIGatewayMistralEmbeddingsModelConfig" - "$ref": "#/components/schemas/AIGatewayOllamaEmbeddingsModelConfig" - "$ref": "#/components/schemas/AIGatewayOpenaiEmbeddingsModelConfig" AIGatewayAzureEmbeddingsModelConfig: description: |- Azure OpenAI-specific configuration for an embeddings model. Azure AI Foundry embeddings are not supported. type: object properties: upstream_url: description: The URL of the embeddings model. type: string type: type: string enum: - azure deployment_id: description: The Azure OpenAI deployment ID for the embeddings model. type: string api_version: description: The Azure OpenAI API version to use. type: string default: '2023-05-15' additionalProperties: false required: - type - deployment_id title: AIGatewayAzureEmbeddingsModelConfig AIGatewayBedrockEmbeddingsModelConfig: description: AWS Bedrock-specific configuration for a model. type: object properties: upstream_url: description: The URL of the embeddings model. type: string type: type: string enum: - bedrock x-terraform-transform-const: true region: description: | The AWS region for the model. Setting this option overrides the AWS_REGION environment variable. type: string batch_bucket_prefix: description: S3 bucket prefix for batch inference jobs. type: string embeddings_normalize: description: Whether to normalize embedding vectors in the response. type: boolean default: false performance_config_latency: description: Latency performance configuration for the model invocation. type: string video_output_s3_uri: description: S3 URI for storing video generation outputs. type: string additionalProperties: false required: - type AIGatewayGeminiEmbeddingsModelConfig: description: Google Gemini-specific configuration for a model. type: object properties: upstream_url: description: The URL of the embeddings model. type: string type: type: string enum: - gemini x-terraform-transform-const: true gcp_environment: "$ref": "#/components/schemas/GCPModelConfig" additionalProperties: false required: - type AIGatewayHuggingfaceEmbeddingsModelConfig: description: Hugging Face-specific configuration for a model. type: object properties: upstream_url: description: The URL of the embeddings model. type: string type: type: string enum: - huggingface x-terraform-transform-const: true use_cache: description: Whether to use the Hugging Face inference cache. type: boolean default: false wait_for_model: description: Whether to wait for the model to load if it is not ready. type: boolean default: false additionalProperties: false required: - type AIGatewayMistralEmbeddingsModelConfig: type: object properties: upstream_url: description: The URL of the embeddings model. type: string type: type: string enum: - mistral additionalProperties: false required: - type AIGatewayOllamaEmbeddingsModelConfig: description: Ollama-specific configuration for a model. type: object properties: upstream_url: description: The URL of the embeddings model. type: string type: type: string enum: - ollama x-terraform-transform-const: true additionalProperties: false required: - type AIGatewayOpenaiEmbeddingsModelConfig: description: Openai-specific configuration for a model. type: object properties: upstream_url: description: The URL of the embeddings model. type: string type: type: string enum: - openai x-terraform-transform-const: true additionalProperties: false required: - type AIGatewayModelVectorDBConfig: description: Configuration for the vector database used by the model. discriminator: propertyName: type mapping: pgvector: "#/components/schemas/AIGatewayModelVectorDBConfigPgVector" redis: "#/components/schemas/AIGatewayModelVectorDBConfigRedis" oneOf: - "$ref": "#/components/schemas/AIGatewayModelVectorDBConfigPgVector" - "$ref": "#/components/schemas/AIGatewayModelVectorDBConfigRedis" AIGatewayModelVectorDBConfigRedis: description: Config for connecting to a Cloud Provider's Redis instance. type: object properties: type: type: string enum: - redis x-terraform-transform-const: true dimensions: description: the desired dimensionality for the vectors type: integer distance_metric: description: the distance metric to use for vector searches type: string enum: - cosine - euclidean threshold: description: the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar. type: number cloud_authentication: description: Auth related config for connecting to a Cloud Provider's Redis instance. discriminator: propertyName: type mapping: aws: "#/components/schemas/AIGatewayRedisAWSAuthentication" azure: "#/components/schemas/AIGatewayRedisAzureAuthentication" gcp: "#/components/schemas/AIGatewayRedisGCPAuthentication" oneOf: - "$ref": "#/components/schemas/AIGatewayRedisAWSAuthentication" - "$ref": "#/components/schemas/AIGatewayRedisAzureAuthentication" - "$ref": "#/components/schemas/AIGatewayRedisGCPAuthentication" cluster: description: Cluster configuration for the Redis connection. type: object additionalProperties: false properties: max_redirections: description: Maximum retry attempts for redirection. type: integer default: 5 maximum: 2147483646 minimum: 0 nodes: description: Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. type: array items: type: object properties: ip: description: A string representing a host name, such as example.com. type: string default: 127.0.0.1 port: description: An integer representing a port number between 0 and 65535, inclusive. type: integer default: 6379 maximum: 65535 minimum: 0 minItems: 1 connect_timeout: description: An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. type: integer default: 2000 maximum: 2147483646 minimum: 0 connection_is_proxied: description: If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address. type: boolean default: false database: description: Database to use for the Redis connection when using the `redis` strategy type: integer default: 0 maximum: 2147483646 minimum: 0 host: description: | A string representing a host name, such as example.com. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string default: 127.0.0.1 x-referenceable: true keepalive: description: Keepalive configuration for the Redis connection. type: object additionalProperties: false properties: backlog: description: Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `pool_size`. type: integer maximum: 2147483646 minimum: 0 pool_size: description: The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `pool_size` nor `backlog` is specified, no pool is created. If `pool_size` isn't specified but `backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. type: integer default: 256 maximum: 2147483646 minimum: 1 password: description: | Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true port: description: | An integer representing a port number between 0 and 65535, inclusive. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). oneOf: - type: integer default: 6379 maximum: 65535 minimum: 0 example: 6379 - type: string example: "{vault://hcv/redis/port}" x-go-type: types.Referenceable x-go-type-import: path: github.com/kong-konnect/koko-private/internal/server/public/openapi/controlplanesconfig/types name: types x-referenceable: true read_timeout: description: An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. type: integer default: 2000 maximum: 2147483646 minimum: 0 send_timeout: description: An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. type: integer default: 2000 maximum: 2147483646 minimum: 0 sentinel: description: Configuration for Redis Sentinel. type: object additionalProperties: false properties: master: description: Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel. type: string nodes: description: Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. type: array items: type: object properties: host: description: A string representing a host name, such as example.com. type: string default: 127.0.0.1 port: description: An integer representing a port number between 0 and 65535, inclusive. type: integer default: 6379 maximum: 65535 minimum: 0 minItems: 1 password: description: | Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true role: description: Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel. type: string enum: - any - master - slave username: description: | Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true server_name: description: | A string representing an SNI (server name indication) value for TLS. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true ssl: description: If set to true, uses SSL to connect to Redis. type: boolean default: true ssl_verify: description: If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly. type: boolean default: true username: description: | Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true additionalProperties: false required: - type - dimensions - distance_metric AIGatewayModelVectorDBConfigPgVector: type: object properties: type: type: string enum: - pgvector x-terraform-transform-const: true dimensions: description: the desired dimensionality for the vectors type: integer distance_metric: description: the distance metric to use for vector searches type: string enum: - cosine - euclidean threshold: description: the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar. type: number database: description: the database of the pgvector database type: string default: kong-pgvector host: description: the host of the pgvector database type: string default: 127.0.0.1 password: description: | the password of the pgvector database This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true port: description: the port of the pgvector database type: integer default: 5432 maximum: 65535 minimum: 0 ssl: type: object additionalProperties: false properties: enabled: description: whether to use ssl for the pgvector database type: boolean default: true cert: description: the path of ssl cert to use for the pgvector database type: string cert_key: description: the path of ssl cert key to use for the pgvector database type: string required: description: whether ssl is required for the pgvector database type: boolean default: true verify: description: whether to verify ssl for the pgvector database type: boolean default: true version: description: the ssl version to use for the pgvector database type: string default: tlsv1_2 enum: - any - tlsv1_2 - tlsv1_3 timeout: description: the timeout of the pgvector database type: number default: 5000 user: description: | the user of the pgvector database This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string default: postgres x-referenceable: true additionalProperties: false required: - type - dimensions - distance_metric AIGatewayModelFormat: description: Request and response format supported by this model. type: object properties: type: description: The format type. type: string example: openai enum: - anthropic - bedrock - cohere - gemini - huggingface - openai additionalProperties: false AIGatewayTarget: description: A target instance a model entry routes requests to. type: object properties: name: description: The name of the model defined in the upstream provider that will be executed. type: string example: gpt-5-model weight: description: The weight this target gets within the upstream load balancer type: integer example: 100 default: 100 maximum: 65535 minimum: 1 semantic_description: description: | The semantic description of the target, required if using semantic load balancing. Specially, setting this to 'CATCHALL' will indicate such target to be used when no other targets match the semantic threshold. type: string allow_auth_override: description: 'When enabled, request-level auth parameters (such as API keys or bearer tokens) will override the static values defined for the provider. ' type: boolean default: false provider: "$ref": "#/components/schemas/AIGatewayModelProviderReference" config: "$ref": "#/components/schemas/AIGatewayTargetConfig" additionalProperties: false required: - name - provider - config AIGatewayTargetConfig: description: Configuration for a target model. discriminator: propertyName: type mapping: anthropic: "#/components/schemas/AIGatewayTargetAnthropicConfig" azure: "#/components/schemas/AIGatewayTargetAzureConfig" bedrock: "#/components/schemas/AIGatewayTargetBedrockConfig" cerebras: "#/components/schemas/AIGatewayTargetCerebrasConfig" cohere: "#/components/schemas/AIGatewayTargetCohereConfig" dashscope: "#/components/schemas/AIGatewayTargetDashscopeConfig" databricks: "#/components/schemas/AIGatewayTargetDatabricksConfig" deepseek: "#/components/schemas/AIGatewayTargetDeepseekConfig" gemini: "#/components/schemas/AIGatewayTargetGeminiConfig" huggingface: "#/components/schemas/AIGatewayTargetHuggingfaceConfig" kimi: "#/components/schemas/AIGatewayTargetKimiConfig" llama2: "#/components/schemas/AIGatewayTargetLlama2Config" mistral: "#/components/schemas/AIGatewayTargetMistralConfig" ollama: "#/components/schemas/AIGatewayTargetOllamaConfig" openai: "#/components/schemas/AIGatewayTargetOpenaiConfig" vercel: "#/components/schemas/AIGatewayTargetVercelConfig" vllm: "#/components/schemas/AIGatewayTargetVllmConfig" xai: "#/components/schemas/AIGatewayTargetXaiConfig" sagemaker: "#/components/schemas/AIGatewayTargetSagemakerConfig" oneOf: - "$ref": "#/components/schemas/AIGatewayTargetAnthropicConfig" - "$ref": "#/components/schemas/AIGatewayTargetAzureConfig" - "$ref": "#/components/schemas/AIGatewayTargetBedrockConfig" - "$ref": "#/components/schemas/AIGatewayTargetCerebrasConfig" - "$ref": "#/components/schemas/AIGatewayTargetCohereConfig" - "$ref": "#/components/schemas/AIGatewayTargetDashscopeConfig" - "$ref": "#/components/schemas/AIGatewayTargetDatabricksConfig" - "$ref": "#/components/schemas/AIGatewayTargetDeepseekConfig" - "$ref": "#/components/schemas/AIGatewayTargetGeminiConfig" - "$ref": "#/components/schemas/AIGatewayTargetHuggingfaceConfig" - "$ref": "#/components/schemas/AIGatewayTargetKimiConfig" - "$ref": "#/components/schemas/AIGatewayTargetLlama2Config" - "$ref": "#/components/schemas/AIGatewayTargetMistralConfig" - "$ref": "#/components/schemas/AIGatewayTargetOllamaConfig" - "$ref": "#/components/schemas/AIGatewayTargetOpenaiConfig" - "$ref": "#/components/schemas/AIGatewayTargetVercelConfig" - "$ref": "#/components/schemas/AIGatewayTargetVllmConfig" - "$ref": "#/components/schemas/AIGatewayTargetXaiConfig" - "$ref": "#/components/schemas/AIGatewayTargetSagemakerConfig" AIGatewayCacheWriteCost: type: object properties: ttl: description: Cache TTL this price applies to, e.g. "5m" or "1h". type: string pattern: "^[0-9]+\\.?[0-9]*[hm]$" cost: description: Cost per 1M cache-write prompt tokens for this TTL. type: number minimum: 0 additionalProperties: false required: - ttl - cost title: AIGatewayCacheWriteCost AIGatewayContextWindowFactor: type: object properties: above: description: Input-token threshold above which the factors apply, e.g. "128k" or "1m". type: string pattern: "^[0-9]+\\.?[0-9]*[km]$" input_factor: description: Multiplier applied to input pricing above the threshold. type: number exclusiveMinimum: true minimum: 0 output_factor: description: Multiplier applied to output pricing above the threshold. type: number exclusiveMinimum: true minimum: 0 additionalProperties: false required: - above - input_factor - output_factor title: AIGatewayContextWindowFactor AIGatewayServiceTierFactor: type: object properties: tier: description: Matched case-insensitively as a substring of the vendor's reported service tier (e.g. "priority", "flex", "throughput"). When more than one entry matches, the longest (most specific) tier wins; array order does not matter. type: string minLength: 1 factor: description: Multiplier applied to the whole request for this service tier. type: number exclusiveMinimum: true minimum: 0 additionalProperties: false required: - tier - factor title: AIGatewayServiceTierFactor AIGatewayTargetAnthropicConfig: description: Anthropic-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - anthropic x-terraform-transform-const: true version: description: The Anthropic API version to use. type: string default: '2023-06-01' required: - type AIGatewayTargetAzureConfig: description: Azure-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - azure x-terraform-transform-const: true deployment_id: description: | The Azure deployment ID for the model. Applies when the Azure provider's `service` is `azure-openai`; not used for `azure-foundry`. type: string api_version: description: The Azure OpenAI API version to use. type: string default: '2023-05-15' foundry_path_prefix: description: | The API path prefix for the Azure AI Foundry endpoint, selecting the model's API surface. `/openai/v1` targets the OpenAI-compatible surface; `/anthropic/v1` targets the Anthropic surface. Applies when the Azure provider's `service` is `azure-foundry`. type: string default: "/openai/v1" enum: - "/openai/v1" - "/anthropic/v1" required: - type AIGatewayTargetBedrockConfig: description: AWS Bedrock-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - bedrock x-terraform-transform-const: true region: description: | The AWS region for the model. Setting this option overrides the AWS_REGION environment variable. type: string batch_bucket_prefix: description: S3 bucket prefix for batch inference jobs. type: string embeddings_normalize: description: Whether to normalize embedding vectors in the response. type: boolean default: false performance_config_latency: description: Latency performance configuration for the model invocation. type: string video_output_s3_uri: description: S3 URI for storing video generation outputs. type: string required: - type AIGatewayTargetCerebrasConfig: description: Cerebras-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - cerebras x-terraform-transform-const: true required: - type AIGatewayTargetCohereConfig: description: Cohere-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - cohere x-terraform-transform-const: true api_version: description: | Cohere API version. `v1` uses the legacy `/v1/chat` endpoint; `v2` (default) uses `/v2/chat` and supports tool calling. type: string default: v2 enum: - v1 - v2 embedding_input_type: description: The intended downstream use of the embeddings to improve model quality. type: string default: classification enum: - classification - clustering - image - search_document - search_query wait_for_model: description: Whether to wait for the model to be ready before sending the request. type: boolean default: false required: - type AIGatewayTargetDashscopeConfig: description: Alibaba DashScope-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - dashscope x-terraform-transform-const: true international: description: Whether to use the international DashScope endpoint. type: boolean default: true required: - type AIGatewayTargetDatabricksConfig: description: Databricks-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - databricks x-terraform-transform-const: true workspace_instance_id: description: The Databricks workspace instance ID. type: string required: - type - workspace_instance_id AIGatewayTargetDeepseekConfig: description: Deepseek-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - deepseek x-terraform-transform-const: true required: - type AIGatewayTargetGeminiConfig: description: Google Gemini-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - gemini x-terraform-transform-const: true gcp_environment: "$ref": "#/components/schemas/GCPModelConfig" required: - type AIGatewayTargetHuggingfaceConfig: description: Hugging Face-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - huggingface x-terraform-transform-const: true use_cache: description: Whether to use the Hugging Face inference cache. type: boolean default: false wait_for_model: description: Whether to wait for the model to load if it is not ready. type: boolean default: false required: - type AIGatewayTargetKimiConfig: description: Kimi (Moonshot AI)-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - kimi x-terraform-transform-const: true international: description: | When `true`, requests are sent to `api.moonshot.ai` (international). When `false`, requests are sent to `api.moonshot.cn` (mainland China). type: boolean default: true required: - type AIGatewayTargetLlama2Config: description: Llama2-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - llama2 x-terraform-transform-const: true format: description: The request format to use when communicating with the Llama2 model. type: string enum: - ollama - openai - raw required: - type - format - upstream_url AIGatewayTargetMistralConfig: description: Mistral-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - mistral x-terraform-transform-const: true format: description: The request format to use when communicating with the Mistral model. type: string enum: - ollama - openai required: - type - format AIGatewayTargetOllamaConfig: description: Ollama-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - ollama x-terraform-transform-const: true required: - type AIGatewayTargetOpenaiConfig: description: Openai-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - openai x-terraform-transform-const: true required: - type AIGatewayTargetVercelConfig: description: Vercel AI Gateway-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - vercel x-terraform-transform-const: true required: - type AIGatewayTargetVllmConfig: description: Vllm-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - vllm x-terraform-transform-const: true required: - type - upstream_url AIGatewayTargetXaiConfig: description: Xai-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - xai x-terraform-transform-const: true required: - type AIGatewayTargetSagemakerConfig: description: AWS SageMaker-specific configuration for a model. type: object properties: embeddings_dimensions: description: The number of dimensions for embedding outputs. type: integer maximum: 2147483646 minimum: 0 max_tokens: description: The maximum number of tokens to generate in the response. type: integer maximum: 2147483646 minimum: 0 input_cost: description: Cost per 1M input tokens for billing and cost tracking. type: number output_cost: description: Cost per 1M output tokens for billing and cost tracking. type: number cache_read_cost: description: Cost per 1M cache-read (cached) prompt tokens for billing and cost tracking. type: number cache_write_cost: description: Cost per 1M cache-write prompt tokens for billing and cost tracking. type: number cache_write_cost_list: description: Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this when the upstream provider charges differently for different cache TTLs. type: array items: "$ref": "#/components/schemas/AIGatewayCacheWriteCost" context_window_factor: description: Above an input-token threshold, scale input and output pricing by the corresponding factor. type: array items: "$ref": "#/components/schemas/AIGatewayContextWindowFactor" service_tier_factor: description: Multiplier applied to the whole request for a service tier. The default factor is 1.0 when no tier matches. type: array items: "$ref": "#/components/schemas/AIGatewayServiceTierFactor" temperature: description: Controls randomness in the model output. Higher values produce more varied responses. type: number top_k: description: Limits the number of highest-probability tokens considered during generation. type: integer maximum: 2147483646 minimum: 0 top_p: description: Nucleus sampling probability mass. Tokens with cumulative probability up to top_p are considered. type: number upstream_url: description: The upstream URL for the model endpoint. type: string format: uri type: type: string enum: - sagemaker x-terraform-transform-const: true aws: type: object additionalProperties: false properties: region: description: Overrides the AWS_REGION environment variable for SageMaker requests. type: string assume_role_arn: description: Assume a different IAM role after authenticating; mutually required with role_session_name. type: string role_session_name: description: Session identifier for the assumed role; mutually required with assume_role_arn. type: string sts_endpoint_url: description: Overrides the STS endpoint when assuming a role. type: string target: type: object additionalProperties: false properties: model: description: Sets the X-Amzn-SageMaker-Target-Model header (multi-model endpoints). type: string variant: description: Sets the X-Amzn-SageMaker-Target-Variant header (A/B variant testing). type: string container_hostname: description: Sets the X-Amzn-SageMaker-Target-Container-Hostname header (multi-container). type: string required: - type GCPModelConfig: description: Configuration for a model hosted on Google Cloud Project. type: object properties: api_endpoint: description: The custom API endpoint for the Gemini model. type: string location_id: description: The Google Cloud location ID for the model endpoint. type: string project_id: description: The Google Cloud project ID for the model endpoint. type: string required: - api_endpoint - location_id - project_id AIGatewayAllowACL: type: object properties: allow: description: List of Consumer Groups Names, or Authenticated Groups Names that are permitted access. type: array items: type: string example: allow: - consumer-group-1 required: - allow AIGatewayDenyACL: type: object properties: deny: description: List of Consumer Groups Names, or Authenticated Groups Names that are denied access. type: array items: type: string example: deny: - consumer-group-1 required: - deny AIGatewayACLS: description: Access control rules. Configure exactly one of `allow` or `deny`. oneOf: - "$ref": "#/components/schemas/AIGatewayAllowACL" - "$ref": "#/components/schemas/AIGatewayDenyACL" AIGatewayAgentAccess: description: Access control configuration for an agent. type: object properties: acls: "$ref": "#/components/schemas/AIGatewayACLS" identity_providers: description: | List of identity providers for granting access to the agent. At most 1 identity provider of each identity provider type can be referenced. Deprecated: use `auth_strategies` instead. The two are mutually exclusive. type: array items: "$ref": "#/components/schemas/AIGatewayIdentityProviderReference" deprecated: true maxItems: 1 auth_strategies: description: | List of auth strategies for granting access to the agent. At most 1 auth strategy of each auth strategy type can be referenced. type: array items: "$ref": "#/components/schemas/AIGatewayAuthStrategyReference" maxItems: 1 additionalProperties: false AIGatewayModelAccess: description: Access control configuration for a model. type: object properties: acls: "$ref": "#/components/schemas/AIGatewayACLS" identity_providers: description: | List of identity providers for granting access to the model. At most 1 identity provider of each identity provider type can be referenced. Deprecated: use `auth_strategies` instead. The two are mutually exclusive. type: array items: "$ref": "#/components/schemas/AIGatewayIdentityProviderReference" deprecated: true auth_strategies: description: | List of auth strategies for granting access to the model. At most 1 auth strategy of each auth strategy type can be referenced. type: array items: "$ref": "#/components/schemas/AIGatewayAuthStrategyReference" additionalProperties: false AIGatewayMCPACLs: description: Access control rules for MCP resources. Configure `allow`, `deny`, or both. type: object properties: allow: description: List of consumer groups that are permitted access. type: array items: type: string deny: description: List of consumer groups that are denied access. type: array items: type: string example: allow: - gold-partner deny: - bronze-partner AIGatewayPolicyReferences: description: List of policy references. type: array items: type: string description: Reference to a policy instance by name. KonnectConfigStoreVault: type: object properties: name: description: | A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities. example: my-awesome-vault allOf: - "$ref": "#/components/schemas/AIGatewayVaultName" description: description: The description of the Vault. type: string example: This vault is used to retrieve redis database access credentials default: '' maxLength: 1024 labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - konnect x-terraform-transform-const: true config: type: object additionalProperties: false properties: config_store_id: description: 'The ID of the Konnect Config Store that contains the secrets. ' type: string example: 77426bee-2bca-4005-81af-284868fd3038 required: - config_store_id required: - name - type - config EnvironmentVariableVault: type: object properties: name: description: | A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities. example: my-awesome-vault allOf: - "$ref": "#/components/schemas/AIGatewayVaultName" description: description: The description of the Vault. type: string example: This vault is used to retrieve redis database access credentials default: '' maxLength: 1024 labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - env x-terraform-transform-const: true config: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean prefix: description: 'The prefix for the environment variable that the value will be stored in. ' type: string example: MY_SECRET_ title: EnvironmentVariableVaultConfig required: - name - type - config AwsSecretsManagerVault: type: object properties: name: description: | A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities. example: my-awesome-vault allOf: - "$ref": "#/components/schemas/AIGatewayVaultName" description: description: The description of the Vault. type: string example: This vault is used to retrieve redis database access credentials default: '' maxLength: 1024 labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - aws x-terraform-transform-const: true config: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 assume_role_arn: description: 'The ARN of the role to assume when retrieving secrets from AWS Secrets Manager. ' type: string endpoint_url: description: | The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme. type: string region: description: The AWS region where your vault is located. type: string example: us-east-1 role_session_name: description: The session name used when assuming a role. type: string default: KongVault sts_endpoint_url: description: | A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts..amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS. type: string required: - role_session_name title: AwsSecretsManagerVaultConfig required: - name - type - config GoogleSecretManagerVault: type: object properties: name: description: | A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities. example: my-awesome-vault allOf: - "$ref": "#/components/schemas/AIGatewayVaultName" description: description: The description of the Vault. type: string example: This vault is used to retrieve redis database access credentials default: '' maxLength: 1024 labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - gcp x-terraform-transform-const: true config: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 project_id: description: | The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. type: string required: - project_id title: GoogleSecretManagerVaultConfig required: - name - type - config AzureKeyVault: type: object properties: name: description: | A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities. example: my-awesome-vault allOf: - "$ref": "#/components/schemas/AIGatewayVaultName" description: description: The description of the Vault. type: string example: This vault is used to retrieve redis database access credentials default: '' maxLength: 1024 labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - azure x-terraform-transform-const: true config: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 credentials_prefix: description: 'The prefix for the credentials stored in the Azure Key Vault. ' type: string default: AZURE vault_uri: description: | The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. type: string location: description: | Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. type: string client_id: description: | The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations. type: string tenant_id: description: | The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context. type: string type: type: string default: secrets enum: - secrets required: - vault_uri - location - type title: AzureKeyVaultConfig required: - name - type - config ConjurVault: type: object properties: name: description: | A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities. example: my-awesome-vault allOf: - "$ref": "#/components/schemas/AIGatewayVaultName" description: description: The description of the Vault. type: string example: This vault is used to retrieve redis database access credentials default: '' maxLength: 1024 labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - conjur x-terraform-transform-const: true config: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 account: description: 'The CyberArk Secrets Manager organization account name. ' type: string api_key: description: 'The API key of the workload identity. ' type: string writeOnly: true endpoint_url: description: 'The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. ' type: string login: description: 'The login name of the workload identity. ' type: string required: - endpoint_url - login - account title: ConjurVaultConfig required: - name - type - config HashiCorpVault: type: object properties: name: description: | A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities. example: my-awesome-vault allOf: - "$ref": "#/components/schemas/AIGatewayVaultName" description: description: The description of the Vault. type: string example: This vault is used to retrieve redis database access credentials default: '' maxLength: 1024 labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - hcv x-terraform-transform-const: true config: "$ref": "#/components/schemas/HashiCorpVaultConfig" required: - name - type - config HashiCorpVaultConfig: description: Configuration for an AI Gateway Vault. discriminator: propertyName: auth_method mapping: token: "#/components/schemas/HashiCorpVaultTokenConfig" cert: "#/components/schemas/HashiCorpVaultCertConfig" jwt: "#/components/schemas/HashiCorpVaultOauth2Config" approle: "#/components/schemas/HashiCorpVaultAppRoleConfig" kubernetes: "#/components/schemas/HashiCorpVaultKubernetesConfig" gcp_iam: "#/components/schemas/HashiCorpVaultGcpIAMConfig" gcp_gce: "#/components/schemas/HashiCorpVaultGcpGCEConfig" aws_ec2: "#/components/schemas/HashiCorpVaultAwsEC2Config" aws_iam: "#/components/schemas/HashiCorpVaultAwsIAMConfig" azure: "#/components/schemas/HashiCorpVaultAzureConfig" oneOf: - "$ref": "#/components/schemas/HashiCorpVaultTokenConfig" - "$ref": "#/components/schemas/HashiCorpVaultCertConfig" - "$ref": "#/components/schemas/HashiCorpVaultOauth2Config" - "$ref": "#/components/schemas/HashiCorpVaultAppRoleConfig" - "$ref": "#/components/schemas/HashiCorpVaultKubernetesConfig" - "$ref": "#/components/schemas/HashiCorpVaultGcpIAMConfig" - "$ref": "#/components/schemas/HashiCorpVaultGcpGCEConfig" - "$ref": "#/components/schemas/HashiCorpVaultAwsEC2Config" - "$ref": "#/components/schemas/HashiCorpVaultAwsIAMConfig" - "$ref": "#/components/schemas/HashiCorpVaultAzureConfig" title: HashiCorpVaultConfig HashiCorpVaultTokenConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - token x-terraform-transform-const: true token: description: The token string to be used for authentication. type: string writeOnly: true required: - host - port - mount - auth_method HashiCorpVaultCertConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - cert x-terraform-transform-const: true cert: description: The client certificate. type: string example: | -----BEGIN CERTIFICATE----- certificate-content -----END CERTIFICATE----- key: description: The key for the client certificate. type: string example: | -----BEGIN PRIVATE KEY----- private-key-content -----END PRIVATE KEY----- writeOnly: true role_name: description: The trusted certificate role name. type: string required: - host - port - mount - auth_method - cert HashiCorpVaultOauth2Config: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - jwt x-terraform-transform-const: true role: description: | The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the `role_type` is `jwt` and the `token_policies` have permissions to read the secrets. type: string example: demo token_endpoint: description: The OAuth2 token endpoint for Hashicorp Vault's OAuth2 auth method. type: string client_id: description: The OAuth2 client ID. type: string client_secret: description: The OAuth2 client secret. type: string writeOnly: true audiences: description: Comma-separated list of OAuth2 audiences. type: string required: - host - port - mount - auth_method - role - token_endpoint - client_id HashiCorpVaultAppRoleConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - approle x-terraform-transform-const: true path: description: 'Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. ' type: string default: approle response_wrapping: description: | Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. type: boolean default: false role_id: description: | Specifies the AppRole role ID in HashiCorp Vault. Either `role_id` or `secret_id_file` must be set. type: string secret_id: description: Defines the AppRole’s secret ID in HashiCorp Vault. type: string secret_id_file: description: | Path to a file containing the AppRole secret ID. Either `role_id` or `secret_id_file` must be set. type: string required: - host - port - mount - auth_method HashiCorpVaultKubernetesConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - kubernetes x-terraform-transform-const: true role: description: 'Role assigned to the Kubernetes service account. ' type: string path: description: 'Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. ' type: string default: kubernetes api_token_file: description: 'Path to the Kubernetes service account token file. ' type: string default: "/run/secrets/kubernetes.io/serviceaccount/token" required: - host - port - mount - auth_method HashiCorpVaultGcpIAMConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - gcp_iam x-terraform-transform-const: true role: description: The role to use for GCP IAM auth. type: string service_account: description: The GCP service account for GCE auth. type: string jwt_exp: description: The JWT expiration time in seconds for GCP auth (0-900) type: integer maximum: 900 minimum: 0 required: - host - port - mount - auth_method - role - service_account - jwt_exp HashiCorpVaultGcpGCEConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - gcp_gce x-terraform-transform-const: true role: description: The role to use for GCP GCE auth. type: string login_path: description: The login path for GCP auth in HashiCorp Vault. type: string default: "/v1/auth/gcp/login" required: - host - port - mount - auth_method - role HashiCorpVaultAzureConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - azure x-terraform-transform-const: true role: description: The role to use for Azure auth. type: string login_path: description: The login path for Azure auth in HashiCorp Vault type: string default: "/v1/auth/azure/login" required: - host - port - mount - auth_method - role HashiCorpVaultAwsEC2Config: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - aws_ec2 x-terraform-transform-const: true role: description: The role to use for AWS EC2 auth. type: string nonce: description: The nonce for AWS EC2 auth. type: string login_path: description: The login path for AWS auth in HashiCorp Vault. type: string default: "/v1/auth/aws/login" required: - host - port - mount - auth_method - role - nonce HashiCorpVaultAwsIAMConfig: type: object properties: base64_decode: description: | Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. type: boolean neg_ttl: description: | Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. type: integer default: 0 maximum: 4294967295 minimum: 0 resurrect_ttl: description: | Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. type: integer default: 100000000 maximum: 4294967295 minimum: 0 ttl: description: | Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. type: integer default: 0 maximum: 4294967295 minimum: 0 host: description: The hostname of your HashiCorp vault. type: string port: description: The port number of your HashiCorp vault. type: integer mount: description: The mount point. type: string default: secret kv: description: The secrets engine version. type: string default: v1 enum: - v1 - v2 protocol: description: The protocol to connect with. type: string default: https enum: - http - https ssl_verify: description: Whether to verify the TLS certificate of the vault when connecting. type: boolean default: true namespace: description: Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. type: string auth_method: type: string enum: - aws_iam x-terraform-transform-const: true role: description: The role to use for AWS IAM auth. type: string region: description: The AWS region for auth. type: string login_path: description: The login path for AWS auth in HashiCorp Vault. type: string default: "/v1/auth/aws/login" access_key_id: description: | The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, `secret_access_key` must also be set. type: string secret_access_key: description: | The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, `access_key_id` must also be set. type: string writeOnly: true sts_endpoint_url: description: | The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side. type: string assume_role_arn: description: | The ARN of the role to assume for AWS IAM authentication. If set, `role_session_name` must also be set. type: string role_session_name: description: | The session name to use when assuming a role for AWS IAM authentication. If set, `assume_role_arn` must also be set. type: string required: - host - port - mount - auth_method - role - region CreateAIGatewayVaultRequest: description: Configuration for an AI Gateway Vault. discriminator: propertyName: type mapping: konnect: "#/components/schemas/KonnectConfigStoreVault" env: "#/components/schemas/EnvironmentVariableVault" aws: "#/components/schemas/AwsSecretsManagerVault" gcp: "#/components/schemas/GoogleSecretManagerVault" azure: "#/components/schemas/AzureKeyVault" conjur: "#/components/schemas/ConjurVault" hcv: "#/components/schemas/HashiCorpVault" oneOf: - "$ref": "#/components/schemas/KonnectConfigStoreVault" - "$ref": "#/components/schemas/EnvironmentVariableVault" - "$ref": "#/components/schemas/AwsSecretsManagerVault" - "$ref": "#/components/schemas/GoogleSecretManagerVault" - "$ref": "#/components/schemas/AzureKeyVault" - "$ref": "#/components/schemas/ConjurVault" - "$ref": "#/components/schemas/HashiCorpVault" UpdateAIGatewayVaultRequest: description: Configuration for an AI Gateway Vault. discriminator: propertyName: type mapping: konnect: "#/components/schemas/KonnectConfigStoreVault" env: "#/components/schemas/EnvironmentVariableVault" aws: "#/components/schemas/AwsSecretsManagerVault" gcp: "#/components/schemas/GoogleSecretManagerVault" azure: "#/components/schemas/AzureKeyVault" conjur: "#/components/schemas/ConjurVault" hcv: "#/components/schemas/HashiCorpVault" oneOf: - "$ref": "#/components/schemas/KonnectConfigStoreVault" - "$ref": "#/components/schemas/EnvironmentVariableVault" - "$ref": "#/components/schemas/AwsSecretsManagerVault" - "$ref": "#/components/schemas/GoogleSecretManagerVault" - "$ref": "#/components/schemas/AzureKeyVault" - "$ref": "#/components/schemas/ConjurVault" - "$ref": "#/components/schemas/HashiCorpVault" AIGatewayVault: description: Configuration for an AI Gateway Vault. type: object properties: id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" discriminator: propertyName: type mapping: konnect: "#/components/schemas/KonnectConfigStoreVault" env: "#/components/schemas/EnvironmentVariableVault" aws: "#/components/schemas/AwsSecretsManagerVault" gcp: "#/components/schemas/GoogleSecretManagerVault" azure: "#/components/schemas/AzureKeyVault" conjur: "#/components/schemas/ConjurVault" hcv: "#/components/schemas/HashiCorpVault" oneOf: - "$ref": "#/components/schemas/KonnectConfigStoreVault" - "$ref": "#/components/schemas/EnvironmentVariableVault" - "$ref": "#/components/schemas/AwsSecretsManagerVault" - "$ref": "#/components/schemas/GoogleSecretManagerVault" - "$ref": "#/components/schemas/AzureKeyVault" - "$ref": "#/components/schemas/ConjurVault" - "$ref": "#/components/schemas/HashiCorpVault" required: - id - created_at - updated_at CreateAIGatewayPolicyRequest: type: object properties: display_name: description: The display name for this policy instance. type: string example: My Cool AI PII Sanitizer Policy maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this policy instance, used as a stable human-readable reference. This value is immutable after creation. example: ai-pii-sanitizer-1234 allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" type: description: | The type of the Policy. This is equivalent to the Kong 3 plugin name. Some examples are: 'ai-sanitizer', 'ai-prompt-guard', and 'rate-limiting'. Note: Plugins have been renamed to Policies in Kong AI Gateway. Policy types and configuration documentation can be found in the [Developer Docs](https://developer.konghq.com/plugins/). type: string example: ai-sanitizer enabled: description: Whether the policy is enabled. type: boolean example: true default: true global: description: Whether the policy is globally applied to all resources. type: boolean example: false default: false config: description: | Configuration for the policy. This is equivalent to the Kong 3 plugin configuration. Note: Plugins have been renamed to Policies in Kong AI Gateway. Policy types and configuration documentation can be found in the [Developer Docs](https://developer.konghq.com/plugins/). type: object example: anonymize: - phone - creditcard stop_on_error: true additionalProperties: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name - type - config UpdateAIGatewayPolicyRequest: type: object properties: display_name: description: The display name for this policy instance. type: string example: My Cool AI PII Sanitizer Policy maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this policy instance, used as a stable human-readable reference. This value is immutable after creation. example: ai-pii-sanitizer-1234 allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" type: description: | The type of the Policy. This is equivalent to the Kong 3 plugin name. Some examples are: 'ai-sanitizer', 'ai-prompt-guard', and 'rate-limiting'. Note: Plugins have been renamed to Policies in Kong AI Gateway. Policy types and configuration documentation can be found in the [Developer Docs](https://developer.konghq.com/plugins/). type: string example: ai-sanitizer enabled: description: Whether the policy is enabled. type: boolean example: true default: true global: description: Whether the policy is globally applied to all resources. type: boolean example: false default: false config: description: | Configuration for the policy. This is equivalent to the Kong 3 plugin configuration. Note: Plugins have been renamed to Policies in Kong AI Gateway. Policy types and configuration documentation can be found in the [Developer Docs](https://developer.konghq.com/plugins/). type: object example: anonymize: - phone - creditcard stop_on_error: true additionalProperties: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name - type - config AIGatewayPolicy: type: object properties: display_name: description: The display name for this policy instance. type: string example: My Cool AI PII Sanitizer Policy maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this policy instance, used as a stable human-readable reference. This value is immutable after creation. example: ai-pii-sanitizer-1234 allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" type: description: | The type of the Policy. This is equivalent to the Kong 3 plugin name. Some examples are: 'ai-sanitizer', 'ai-prompt-guard', and 'rate-limiting'. Note: Plugins have been renamed to Policies in Kong AI Gateway. Policy types and configuration documentation can be found in the [Developer Docs](https://developer.konghq.com/plugins/). type: string example: ai-sanitizer enabled: description: Whether the policy is enabled. type: boolean example: true default: true global: description: Whether the policy is globally applied to all resources. type: boolean example: false default: false config: description: | Configuration for the policy. This is equivalent to the Kong 3 plugin configuration. Note: Plugins have been renamed to Policies in Kong AI Gateway. Policy types and configuration documentation can be found in the [Developer Docs](https://developer.konghq.com/plugins/). type: object example: anonymize: - phone - creditcard stop_on_error: true additionalProperties: true labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - display_name - name - type - config - id - created_at - updated_at CreateAIGatewayAgentRequest: type: object properties: display_name: description: The display name for this agent. type: string example: Kong Air Flight Booking Agent maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this agent, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flight-booking-agent allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the Agent is enabled. type: boolean example: true default: true type: description: The type of the agent. type: string example: a2a enum: - a2a - http policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" access: "$ref": "#/components/schemas/AIGatewayAgentAccess" config: description: Configuration for the agent. The structure varies depending on the agent type. type: object additionalProperties: false properties: url: description: | Helper field to set protocol, host, port and path of the upstream A2A Agent using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} type: string format: uri example: https://booking-agent.internal.kongair.com upstream: "$ref": "#/components/schemas/AIGatewayUpstreamConfig" route: "$ref": "#/components/schemas/AIGatewayRouteConfig" proxy: "$ref": "#/components/schemas/AIGatewayProxyConfig" max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false max_payload_size: description: Maximum size in bytes for logged request/response payloads. Payloads exceeding this size will be truncated. type: integer example: 524288 default: 1048576 maximum: 2147483646 minimum: 0 required: - url labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name - type - config UpdateAIGatewayAgentRequest: type: object properties: display_name: description: The display name for this agent. type: string example: Kong Air Flight Booking Agent maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this agent, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flight-booking-agent allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the Agent is enabled. type: boolean example: true default: true type: description: The type of the agent. type: string example: a2a enum: - a2a - http policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" access: "$ref": "#/components/schemas/AIGatewayAgentAccess" config: description: Configuration for the agent. The structure varies depending on the agent type. type: object additionalProperties: false properties: url: description: | Helper field to set protocol, host, port and path of the upstream A2A Agent using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} type: string format: uri example: https://booking-agent.internal.kongair.com upstream: "$ref": "#/components/schemas/AIGatewayUpstreamConfig" route: "$ref": "#/components/schemas/AIGatewayRouteConfig" proxy: "$ref": "#/components/schemas/AIGatewayProxyConfig" max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false max_payload_size: description: Maximum size in bytes for logged request/response payloads. Payloads exceeding this size will be truncated. type: integer example: 524288 default: 1048576 maximum: 2147483646 minimum: 0 required: - url labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name - type - config AIGatewayAgent: type: object properties: display_name: description: The display name for this agent. type: string example: Kong Air Flight Booking Agent maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this agent, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flight-booking-agent allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the Agent is enabled. type: boolean example: true default: true type: description: The type of the agent. type: string example: a2a enum: - a2a - http policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" access: "$ref": "#/components/schemas/AIGatewayAgentAccess" config: description: Configuration for the agent. The structure varies depending on the agent type. type: object additionalProperties: false properties: url: description: | Helper field to set protocol, host, port and path of the upstream A2A Agent using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} type: string format: uri example: https://booking-agent.internal.kongair.com upstream: "$ref": "#/components/schemas/AIGatewayUpstreamConfig" route: "$ref": "#/components/schemas/AIGatewayRouteConfig" proxy: "$ref": "#/components/schemas/AIGatewayProxyConfig" max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false max_payload_size: description: Maximum size in bytes for logged request/response payloads. Payloads exceeding this size will be truncated. type: integer example: 524288 default: 1048576 maximum: 2147483646 minimum: 0 required: - url labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - display_name - name - type - config - id - created_at - updated_at CreateAIGatewayConsumerRequest: description: Configuration for an AI Gateway Consumer. type: object properties: display_name: description: The display name for this consumer instance. type: string example: Greg's Dev Consumer maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this consumer, used as a stable human-readable reference. This value is immutable after creation. example: gregs-dev-consumer allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" type: description: The type of the consumer. type: string enum: - api-key - oauth custom_id: description: Identifier for mapping the consumer when using OAuth authentication. type: string example: dev-users policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name - type UpdateAIGatewayConsumerRequest: description: Configuration for an AI Gateway Consumer. type: object properties: display_name: description: The display name for this consumer instance. type: string example: Greg's Dev Consumer maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this consumer, used as a stable human-readable reference. This value is immutable after creation. example: gregs-dev-consumer allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" type: description: The type of the consumer. type: string enum: - api-key - oauth custom_id: description: Identifier for mapping the consumer when using OAuth authentication. type: string example: dev-users policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name - type AIGatewayConsumer: description: Configuration for an AI Gateway Consumer. type: object properties: display_name: description: The display name for this consumer instance. type: string example: Greg's Dev Consumer maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this consumer, used as a stable human-readable reference. This value is immutable after creation. example: gregs-dev-consumer allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" type: description: The type of the consumer. type: string enum: - api-key - oauth custom_id: description: Identifier for mapping the consumer when using OAuth authentication. type: string example: dev-users policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" required: - display_name - name - type - id - created_at - updated_at AIGatewayConsumerCredential: type: object properties: display_name: description: The display name for this credential instance. type: string example: Greg's Dev Key name: description: A user-defined unique identifier for this credential, used as a stable human-readable reference. This value is immutable after creation. example: gregs-dev-key allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string example: api-key enum: - api-key ttl: description: The API Key's time-to-live in seconds. A value of 0 means the API Key never expires. type: integer example: 86400 default: 0 id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - display_name - name - type - id - created_at - updated_at AIGatewayConsumerCredentialWithKey: type: object properties: display_name: description: The display name for this credential instance. type: string example: Greg's Dev Key name: description: A user-defined unique identifier for this credential, used as a stable human-readable reference. This value is immutable after creation. example: gregs-dev-key allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string example: api-key enum: - api-key ttl: description: The API Key's time-to-live in seconds. A value of 0 means the API Key never expires. type: integer example: 86400 default: 0 api_key: description: The API Key value. If not provided, then the key will be auto generated by the server and returned in the response. type: string example: sk-387788hd3xnej id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - display_name - name - id - created_at - updated_at - type - api_key CreateAIGatewayConsumerCredentialRequest: type: object properties: display_name: description: The display name for this credential instance. type: string example: Greg's Dev Key name: description: A user-defined unique identifier for this credential, used as a stable human-readable reference. This value is immutable after creation. example: gregs-dev-key allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string example: api-key enum: - api-key ttl: description: The API Key's time-to-live in seconds. A value of 0 means the API Key never expires. type: integer example: 86400 default: 0 api_key: description: The API Key value. If not provided, then the key will be auto generated by the server and returned in the response. type: string example: sk-387788hd3xnej writeOnly: true additionalProperties: false required: - display_name - name - type CreateAIGatewayConsumerGroupRequest: type: object properties: display_name: description: The display name for this consumer group instance. type: string example: Dev Users Group maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this consumer group, used as a stable human-readable reference. This value is immutable after creation. example: dev-users allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name UpdateAIGatewayConsumerGroupRequest: type: object properties: display_name: description: The display name for this consumer group instance. type: string example: Dev Users Group maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this consumer group, used as a stable human-readable reference. This value is immutable after creation. example: dev-users allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - display_name - name AddAIGatewayConsumerToGroupRequest: properties: consumer: description: The ID or name of the consumer to add to the group. type: string example: cf4c7e60-11db-49dd-b300-7c7e5f0f7e6b additionalProperties: false required: - consumer AIGatewayConsumerGroup: type: object properties: display_name: description: The display name for this consumer group instance. type: string example: Dev Users Group maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this consumer group, used as a stable human-readable reference. This value is immutable after creation. example: dev-users allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" required: - display_name - name - id - created_at - updated_at AIGatewayMCPServerConversionOnly: type: object properties: type: type: string enum: - conversion-only x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerWithUpstreamNoProxyConfigNoServerConfig" tools: description: List of tools exposed by this MCP Server. type: array items: "$ref": "#/components/schemas/AIGatewayMCPConversionTool" minItems: 1 display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - type - config - tools - display_name - name AIGatewayMCPServerConversionListener: type: object properties: type: type: string enum: - conversion-listener x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerWithUpstreamNoProxyConfig" tools: description: | List of tools exposed by this MCP Server. Each tool's `path`, `method`, and `host` describe the backend HTTP operation on the upstream selected by `config.url` — they do not need to match the public MCP Route configured in `config.route`. type: array items: "$ref": "#/components/schemas/AIGatewayMCPConversionTool" minItems: 1 access: "$ref": "#/components/schemas/AIGatewayMCPServerListenerAccess" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - type - config - tools - display_name - name AIGatewayMCPServerListener: type: object properties: type: type: string enum: - listener x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerNoUpstreamConfig" sources: description: | The explicit list of source MCP Servers whose tools this listener exposes. Each entry is the immutable `name` of a `conversion-only` (toolset) or `upstream-server` (third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. type: array items: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" example: - kongair-flights - github-mcp minItems: 1 access: "$ref": "#/components/schemas/AIGatewayMCPServerListenerAccess" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - type - config - sources - display_name - name AIGatewayMCPServerPassthroughListener: type: object properties: type: type: string enum: - passthrough-listener x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerWithUpstreamConfig" tools: description: | Per-tool access-control overrides for tools advertised by the remote MCP Server. Each entry is matched to a remote tool by `name`; only its access-control rules are applied. type: array items: "$ref": "#/components/schemas/AIGatewayMCPPassthroughTool" access: "$ref": "#/components/schemas/AIGatewayMCPServerListenerAccess" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - type - config - display_name - name AIGatewayMCPServerUpstreamServer: type: object properties: type: type: string enum: - upstream-server x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServerConfig" tools: description: 'List of tools exposed by this MCP Server. ' type: array items: "$ref": "#/components/schemas/AIGatewayMCPUpstreamTool" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false required: - type - config - display_name - name AIGatewayMCPToolAccess: description: Access-control rules for a tool. type: object properties: acls: description: | Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server. allOf: - "$ref": "#/components/schemas/AIGatewayMCPACLs" additionalProperties: false AIGatewayMCPPassthroughTool: description: 'A tool exposed by an MCP Server in `passthrough-listener` mode. ' type: object properties: access: "$ref": "#/components/schemas/AIGatewayMCPToolAccess" name: description: Tool identifier used to match remote MCP Server tools for ACL enforcement. type: string additionalProperties: false required: - name - access title: AIGatewayMCPPassthroughTool AIGatewayMCPConversionTool: description: A tool exposed by an MCP Server in `conversion-only` or `conversion-listener` mode. type: object properties: access: "$ref": "#/components/schemas/AIGatewayMCPToolAccess" annotations: "$ref": "#/components/schemas/AIGatewayMCPToolAnnotations" description: description: A description of what the tool does. type: string example: Search for available flights name: description: The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. type: string headers: "$ref": "#/components/schemas/AIGatewayMCPToolHeaders" host: description: The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required. type: string method: description: The HTTP method used when forwarding the request to the upstream API. type: string enum: - DELETE - GET - PATCH - POST - PUT path: description: | The path of the exported API. Always treated as relative to the path component of `config.url` and simply concatenated onto it — a leading `/` has no special "absolute path" meaning. If this tool's `host` or `scheme` overrides the source's URL, `path` is instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. type: string query: "$ref": "#/components/schemas/AIGatewayMCPToolQuery" request_body: "$ref": "#/components/schemas/AIGatewayMCPToolRequestBody" responses: "$ref": "#/components/schemas/AIGatewayMCPToolResponses" scheme: description: The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. type: string enum: - http - https parameters: "$ref": "#/components/schemas/AIGatewayMCPToolParameters" additionalProperties: false required: - name - description - method AIGatewayMCPServerListenerAccess: default: acl_attribute_type: consumer discriminator: propertyName: acl_attribute_type mapping: consumer: "#/components/schemas/AIGatewayMCPServerListenerConsumer" oauth_access_token: "#/components/schemas/AIGatewayMCPServerListenerOauth" oneOf: - "$ref": "#/components/schemas/AIGatewayMCPServerListenerConsumer" - "$ref": "#/components/schemas/AIGatewayMCPServerListenerOauth" AIGatewayMCPServerListenerConsumer: description: | Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. type: object properties: acl_attribute_type: description: The type of attributes that ACL is evaluated with. type: string default: consumer enum: - consumer x-terraform-transform-const: true acls: description: | Server-level access control rules for allowing or denying consumer groups. This is the top-level gate: a caller's consumer group must pass this check before any MCP protocol operation (`initialize`, `tools/list`, `tools/call`) is allowed, and before any tool-level `default_tool_acls` or per-tool `access.acls` check is evaluated. allOf: - "$ref": "#/components/schemas/AIGatewayMCPACLs" default_tool_acls: description: | Default per-tool access control rules for allowing or denying consumer groups access to tools. Evaluated only for callers that already passed the server-level `acls` check above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's own `access.acls`. allOf: - "$ref": "#/components/schemas/AIGatewayMCPACLs" identity_providers: description: | List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. Deprecated: use `auth_strategies` instead. The two are mutually exclusive. type: array items: "$ref": "#/components/schemas/AIGatewayIdentityProviderReference" deprecated: true maxItems: 1 auth_strategies: description: | List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced. type: array items: "$ref": "#/components/schemas/AIGatewayAuthStrategyReference" maxItems: 1 metadata: description: OAuth 2.0 Protected Resource Metadata advertised for this MCP server. allOf: - "$ref": "#/components/schemas/AIGatewayMCPServerProtectedResourceMetadata" additionalProperties: false required: - acl_attribute_type title: AIGatewayMCPServerBaseACLPropertiesConsumer AIGatewayMCPServerListenerOauth: description: | Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server. type: object properties: acl_attribute_type: description: The type of attributes that ACL is evaluated with. type: string enum: - oauth_access_token x-terraform-transform-const: true access_token_claim_field: description: | The claim in the OAuth2 access token to use as the subject for ACL evaluation when `acl_attribute_type` is set to `oauth_access_token`. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index type: string acls: description: | Server-level access control rules for allowing or denying callers, evaluated against the value of the configured `access_token_claim_field`. This is the top-level gate: a caller must pass this check before any MCP protocol operation (`initialize`, `tools/list`, `tools/call`) is allowed, and before any tool-level `default_tool_acls` or per-tool `access.acls` check is evaluated. allOf: - "$ref": "#/components/schemas/AIGatewayMCPACLs" default_tool_acls: description: | Default per-tool access control rules for allowing or denying callers access to tools, evaluated against the value of the configured `access_token_claim_field`. Evaluated only for callers that already passed the server-level `acls` check above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's own `access.acls`. allOf: - "$ref": "#/components/schemas/AIGatewayMCPACLs" identity_providers: description: | List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced. Deprecated: use `auth_strategies` instead. The two are mutually exclusive. type: array items: "$ref": "#/components/schemas/AIGatewayIdentityProviderReference" deprecated: true maxItems: 1 auth_strategies: description: | List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced. type: array items: "$ref": "#/components/schemas/AIGatewayAuthStrategyReference" maxItems: 1 metadata: description: OAuth 2.0 Protected Resource Metadata advertised for this MCP server. allOf: - "$ref": "#/components/schemas/AIGatewayMCPServerProtectedResourceMetadata" additionalProperties: false required: - acl_attribute_type - access_token_claim_field title: AIGatewayMCPServerBaseACLPropertiesOauth AIGatewayMCPServerProtectedResourceMetadata: description: | OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised for this MCP server, allowing clients to discover the authorization servers that protect it. type: object properties: discovery_endpoint: description: The authorization server metadata discovery URL. type: string endpoint: description: The URL path where the OAuth 2.0 Protected Resource Metadata is served. type: string authorization_servers: description: List of authorization server issuer URLs that can issue tokens for this resource. type: array items: type: string resource: description: The protected resource's identifier (resource URI). type: string scopes_supported: description: List of OAuth scopes supported by the protected resource. type: array items: type: string title: AIGatewayMCPServerProtectedResourceMetadata AIGatewayRedisAWSAuthentication: description: AWS specific configs for connecting to a Cloud Provider's redis instance. type: object properties: type: type: string enum: - aws x-terraform-transform-const: true access_key_id: description: | AWS Access Key ID to be used for authentication. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true assume_role_arn: description: | The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true cache_name: description: | The name of the AWS Elasticache cluster. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true is_serverless: description: This flag specifies whether the cluster is serverless. type: boolean default: true region: description: | The region of the AWS ElastiCache cluster. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true role_session_name: description: | The session name for the temporary credentials when assuming the IAM role. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true secret_access_key: description: | AWS Secret Access Key. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true additionalProperties: false required: - type title: AIGatewayRedisAWSAuthentication AIGatewayRedisAzureAuthentication: description: Azure specific configs for connecting to a Cloud Provider's redis instance. type: object properties: type: type: string enum: - azure x-terraform-transform-const: true client_id: description: | Azure Client ID. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true client_secret: description: | Azure Client Secret. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true tenant_id: description: | Azure Tenant ID. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true additionalProperties: false required: - type title: AIGatewayRedisAzureAuthentication AIGatewayRedisGCPAuthentication: description: GCP specific configs for connecting to a Cloud Provider's redis instance. type: object properties: type: type: string enum: - gcp x-terraform-transform-const: true service_account_json: description: | GCP Service Account JSON. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true additionalProperties: false required: - type title: AIGatewayRedisGCPAuthentication AIGatewayRedisCloudConfiguration: description: Config for connecting to a Cloud Provider's Redis instance. type: object properties: cloud_authentication: description: Auth related config for connecting to a Cloud Provider's Redis instance. discriminator: propertyName: type mapping: aws: "#/components/schemas/AIGatewayRedisAWSAuthentication" azure: "#/components/schemas/AIGatewayRedisAzureAuthentication" gcp: "#/components/schemas/AIGatewayRedisGCPAuthentication" oneOf: - "$ref": "#/components/schemas/AIGatewayRedisAWSAuthentication" - "$ref": "#/components/schemas/AIGatewayRedisAzureAuthentication" - "$ref": "#/components/schemas/AIGatewayRedisGCPAuthentication" cluster: description: Cluster configuration for the Redis connection. type: object additionalProperties: false properties: max_redirections: description: Maximum retry attempts for redirection. type: integer default: 5 maximum: 2147483646 minimum: 0 nodes: description: Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. type: array items: type: object properties: ip: description: A string representing a host name, such as example.com. type: string default: 127.0.0.1 port: description: An integer representing a port number between 0 and 65535, inclusive. type: integer default: 6379 maximum: 65535 minimum: 0 minItems: 1 connect_timeout: description: An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. type: integer default: 2000 maximum: 2147483646 minimum: 0 connection_is_proxied: description: If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address. type: boolean default: false database: description: Database to use for the Redis connection when using the `redis` strategy type: integer default: 0 maximum: 2147483646 minimum: 0 host: description: | A string representing a host name, such as example.com. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string default: 127.0.0.1 x-referenceable: true keepalive: description: Keepalive configuration for the Redis connection. type: object additionalProperties: false properties: backlog: description: Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `pool_size`. type: integer maximum: 2147483646 minimum: 0 pool_size: description: The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `pool_size` nor `backlog` is specified, no pool is created. If `pool_size` isn't specified but `backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. type: integer default: 256 maximum: 2147483646 minimum: 1 password: description: | Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true port: description: | An integer representing a port number between 0 and 65535, inclusive. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). oneOf: - type: integer default: 6379 maximum: 65535 minimum: 0 example: 6379 - type: string example: "{vault://hcv/redis/port}" x-go-type: types.Referenceable x-go-type-import: path: github.com/kong-konnect/koko-private/internal/server/public/openapi/controlplanesconfig/types name: types x-referenceable: true read_timeout: description: An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. type: integer default: 2000 maximum: 2147483646 minimum: 0 send_timeout: description: An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. type: integer default: 2000 maximum: 2147483646 minimum: 0 sentinel: description: Configuration for Redis Sentinel. type: object additionalProperties: false properties: master: description: Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel. type: string nodes: description: Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. type: array items: type: object properties: host: description: A string representing a host name, such as example.com. type: string default: 127.0.0.1 port: description: An integer representing a port number between 0 and 65535, inclusive. type: integer default: 6379 maximum: 65535 minimum: 0 minItems: 1 password: description: | Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true role: description: Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel. type: string enum: - any - master - slave username: description: | Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true server_name: description: | A string representing an SNI (server name indication) value for TLS. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true ssl: description: If set to true, uses SSL to connect to Redis. type: boolean default: true ssl_verify: description: If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly. type: boolean default: true username: description: | Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true additionalProperties: false AIGatewayProxyConfig: description: HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider. type: object properties: http_proxy: description: HTTP proxy server to route plaintext outbound requests through. type: object additionalProperties: false properties: host: description: A string representing a host name, such as example.com. type: string port: description: An integer representing a port number between 0 and 65535, inclusive. type: integer maximum: 65535 minimum: 0 https_proxy: description: HTTPS proxy server to route TLS outbound requests through. type: object additionalProperties: false properties: host: description: A string representing a host name, such as example.com. type: string port: description: An integer representing a port number between 0 and 65535, inclusive. type: integer maximum: 65535 minimum: 0 proxy_scheme: description: The proxy scheme to use when connecting to the proxy server. type: string default: http enum: - http auth: description: Credentials used to authenticate to the proxy server. type: object additionalProperties: false properties: username: description: | The username to use for proxy authentication. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true password: description: | The password to use for proxy authentication. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true no_proxy: description: Comma-separated list of hosts that should not be proxied. type: string additionalProperties: false AIGatewayRouteConfig: description: Configuration for an AI Gateway route. type: object properties: headers: description: 'One or more lists of values indexed by header name that will cause this route to match if present in the request. The `Host` header cannot be used with this attribute: hosts should be specified using the `hosts` attribute. When `headers` contains only one value and that value starts with the special prefix `~*`, the value is interpreted as a regular expression.' type: object example: version: - v1 - v2 additionalProperties: true hosts: description: A list of domain names that match this route. Note that the hosts value is case sensitive. type: array items: type: string example: foo.example.com https_redirect_status_code: description: 'The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is `HTTP` instead of `HTTPS`. `Location` header is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept the `https` protocol.' type: integer default: 426 maximum: 599 minimum: 100 methods: description: A list of HTTP methods that match this route. type: array items: type: string paths: description: A list of paths that match this route. type: array items: type: string preserve_host: description: When matching a route via one of the `hosts` domain names, use the request `Host` header in the upstream request headers. If set to `false`, the upstream `Host` header will be that of the service's `host`. type: boolean default: false protocols: description: An array of the protocols this route should allow. See the [route Object](#route-object) section for a list of accepted protocols. When set to only `https`, HTTP requests are answered with an upgrade error. When set to only `http`, HTTPS requests are answered with an error. type: array items: type: string default: - http - https regex_priority: description: A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same `regex_priority`, the older one (lowest `created_at`) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). type: integer default: 0 maximum: 2147483647 minimum: -2147483648 request_buffering: description: Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. type: boolean default: true response_buffering: description: Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. type: boolean default: true strip_path: description: When matching a route via one of the `paths`, strip the matching prefix from the upstream request URL. type: boolean default: true tags: description: An optional set of strings associated with the route for grouping and filtering. type: array items: type: string additionalProperties: false AIGatewayLoggingConfig: description: Configuration for AI Gateway logging. type: object properties: payloads: type: boolean default: false additionalProperties: false AIGatewayMCPServerNoUpstreamConfig: description: Routing, logging, and server configuration for the MCP Server. type: object properties: route: "$ref": "#/components/schemas/AIGatewayMCPServerRouteWithMatcher" logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false audits: type: boolean default: false max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 server: "$ref": "#/components/schemas/AIGatewayMCPServerServerConfigBase" additionalProperties: false AIGatewayMCPServerWithUpstreamNoProxyConfigNoServerConfig: description: Routing, logging, and request body size limits for the MCP Server. type: object properties: route: "$ref": "#/components/schemas/AIGatewayMCPServerRouteWithMatcher" logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false audits: type: boolean default: false max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 url: description: | Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} type: string format: uri example: https://mcp.internal.kongair.com upstream: "$ref": "#/components/schemas/AIGatewayUpstreamConfig" additionalProperties: false required: - url AIGatewayMCPServerWithUpstreamNoProxyConfig: description: Routing, logging, and server configuration for the MCP Server. type: object properties: route: "$ref": "#/components/schemas/AIGatewayMCPServerRouteWithMatcher" logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false audits: type: boolean default: false max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 server: "$ref": "#/components/schemas/AIGatewayMCPServerServerConfigBase" url: description: | Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} type: string format: uri example: https://mcp.internal.kongair.com upstream: "$ref": "#/components/schemas/AIGatewayUpstreamConfig" additionalProperties: false required: - url AIGatewayMCPServerWithUpstreamConfig: description: Routing, logging, and server configuration for the MCP Server. type: object properties: route: "$ref": "#/components/schemas/AIGatewayMCPServerRouteWithMatcher" logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false audits: type: boolean default: false max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 server: "$ref": "#/components/schemas/AIGatewayMCPServerServerConfigBase" url: description: | Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} type: string format: uri example: https://mcp.internal.kongair.com upstream: "$ref": "#/components/schemas/AIGatewayUpstreamConfig" proxy: "$ref": "#/components/schemas/AIGatewayProxyConfig" additionalProperties: false required: - url AIGatewayMCPServerRouteWithMatcher: description: | Route configuration for an MCP Server that terminates its own listener. At least one of `hosts`, `paths`, `methods`, or `headers` must be set so the route can match incoming requests. type: object allOf: - "$ref": "#/components/schemas/AIGatewayRouteConfig" - anyOf: - required: - hosts properties: hosts: minItems: 1 - required: - paths properties: paths: minItems: 1 - required: - methods properties: methods: minItems: 1 - required: - headers properties: headers: minProperties: 1 AIGatewayMCPServerUpstreamServerConfig: description: Routing, logging, and server configuration for the MCP Server. type: object properties: route: "$ref": "#/components/schemas/AIGatewayMCPServerRouteWithMatcher" logging: description: Configuration for AI Gateway logging. type: object additionalProperties: false properties: payloads: type: boolean default: false audits: type: boolean default: false max_request_body_size: description: Maximum size of request body to parse. Set to 0 for unlimited. type: integer default: 8388608 maximum: 2147483646 minimum: 0 server: "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServerServerConfig" url: description: | Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} type: string format: uri example: https://mcp.internal.kongair.com upstream: "$ref": "#/components/schemas/AIGatewayUpstreamConfig" tools_cache_ttl_seconds: description: | The time-to-live (TTL) for the upstream tools cache in seconds. Set to `0` to refresh on every client call. type: integer minimum: 0 additionalProperties: false required: - url - tools_cache_ttl_seconds AIGatewayMCPServerServerConfigBase: description: Server-side configuration for the MCP Server. type: object properties: forward_client_headers: description: Whether to forward the client request headers to the upstream server when calling the tools. type: boolean default: true session: description: | Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers. type: object additionalProperties: false properties: client: description: The configuration for client-side session storage. type: object additionalProperties: false properties: secrets: description: | The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation. type: array items: type: string minLength: 8 x-referenceable: true description: 'This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). ' minItems: 1 managed: description: If enabled, Kong will maintain managed sessions with the MCP server. type: boolean default: true redis: "$ref": "#/components/schemas/AIGatewayRedisCloudConfiguration" session_ttl: description: The time-to-live (TTL) for each session in seconds. type: integer default: 86400 maximum: 2147483646 minimum: 0 strategy: description: The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. type: string enum: - client - redis timeout: description: The timeout for calling the tools in milliseconds. type: integer default: 10000 maximum: 2147483646 minimum: 0 additionalProperties: false AIGatewayMCPServerUpstreamServerServerConfig: description: Server-side configuration specific to `upstream-server` mode. type: object properties: forward_client_headers: description: Whether to forward the client request headers to the upstream server when calling the tools. type: boolean default: true session: description: | Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers. type: object additionalProperties: false properties: client: description: The configuration for client-side session storage. type: object additionalProperties: false properties: secrets: description: | The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation. type: array items: type: string minLength: 8 x-referenceable: true description: 'This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). ' minItems: 1 managed: description: If enabled, Kong will maintain managed sessions with the MCP server. type: boolean default: true redis: "$ref": "#/components/schemas/AIGatewayRedisCloudConfiguration" session_ttl: description: The time-to-live (TTL) for each session in seconds. type: integer default: 86400 maximum: 2147483646 minimum: 0 strategy: description: The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. type: string enum: - client - redis timeout: description: The timeout for calling the tools in milliseconds. type: integer default: 10000 maximum: 2147483646 minimum: 0 preserve_upstream_tool_names: description: | If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server. If disabled (`false`), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. type: boolean default: false tools_list_auth: "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServerServerToolAuthConfig" additionalProperties: false AIGatewayMCPServerUpstreamServerServerToolAuthConfig: description: Configuration for an Upstream Server's MCP Server Tools' Authentication. discriminator: propertyName: type mapping: jwt: "#/components/schemas/AIGatewayMCPServerUpstreamServerToolOauth2ConfigJwt" credentials: "#/components/schemas/AIGatewayMCPServerUpstreamServerToolOauth2ConfigCredentials" oneOf: - "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServerToolOauth2ConfigJwt" - "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServerToolOauth2ConfigCredentials" AIGatewayMCPServerUpstreamServerToolOauth2ConfigJwt: type: object properties: scope: description: | The scopes for the OAuth 2.0 client-credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true access_token_header: description: | Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. type: string default: Authorization id_token_header: description: | Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list. type: string type: type: string enum: - jwt x-terraform-transform-const: true additionalProperties: false required: - type AIGatewayMCPServerUpstreamServerToolOauth2ConfigCredentials: type: object properties: scope: description: | The scopes for the OAuth 2.0 client-credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true access_token_header: description: | Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. type: string default: Authorization id_token_header: description: | Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list. type: string type: type: string enum: - credentials x-terraform-transform-const: true token_endpoint: description: | The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string format: uri x-referenceable: true client_id: description: | The client ID for the OAuth 2.0 client-credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true client_secret: description: | The client secret for the OAuth 2.0 client-credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true additionalProperties: false required: - type - token_endpoint - client_id CreateAIGatewayMCPServerRequest: discriminator: propertyName: type mapping: conversion-only: "#/components/schemas/AIGatewayMCPServerConversionOnly" conversion-listener: "#/components/schemas/AIGatewayMCPServerConversionListener" listener: "#/components/schemas/AIGatewayMCPServerListener" passthrough-listener: "#/components/schemas/AIGatewayMCPServerPassthroughListener" upstream-server: "#/components/schemas/AIGatewayMCPServerUpstreamServer" oneOf: - "$ref": "#/components/schemas/AIGatewayMCPServerConversionOnly" - "$ref": "#/components/schemas/AIGatewayMCPServerConversionListener" - "$ref": "#/components/schemas/AIGatewayMCPServerListener" - "$ref": "#/components/schemas/AIGatewayMCPServerPassthroughListener" - "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServer" UpdateAIGatewayMCPServerRequest: discriminator: propertyName: type mapping: conversion-only: "#/components/schemas/AIGatewayMCPServerConversionOnly" conversion-listener: "#/components/schemas/AIGatewayMCPServerConversionListener" listener: "#/components/schemas/AIGatewayMCPServerListener" passthrough-listener: "#/components/schemas/AIGatewayMCPServerPassthroughListener" upstream-server: "#/components/schemas/AIGatewayMCPServerUpstreamServer" oneOf: - "$ref": "#/components/schemas/AIGatewayMCPServerConversionOnly" - "$ref": "#/components/schemas/AIGatewayMCPServerConversionListener" - "$ref": "#/components/schemas/AIGatewayMCPServerListener" - "$ref": "#/components/schemas/AIGatewayMCPServerPassthroughListener" - "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServer" AIGatewayMCPServer: type: object properties: id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" discriminator: propertyName: type mapping: conversion-only: "#/components/schemas/AIGatewayMCPServerConversionOnlyResponse" conversion-listener: "#/components/schemas/AIGatewayMCPServerConversionListenerResponse" listener: "#/components/schemas/AIGatewayMCPServerListenerResponse" passthrough-listener: "#/components/schemas/AIGatewayMCPServerPassthroughListenerResponse" upstream-server: "#/components/schemas/AIGatewayMCPServerUpstreamServerResponse" oneOf: - "$ref": "#/components/schemas/AIGatewayMCPServerConversionOnlyResponse" - "$ref": "#/components/schemas/AIGatewayMCPServerConversionListenerResponse" - "$ref": "#/components/schemas/AIGatewayMCPServerListenerResponse" - "$ref": "#/components/schemas/AIGatewayMCPServerPassthroughListenerResponse" - "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServerResponse" required: - id - created_at - updated_at AIGatewayMCPServerConversionOnlyResponse: type: object properties: type: type: string enum: - conversion-only x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerWithUpstreamNoProxyConfigNoServerConfig" tools: description: List of tools exposed by this MCP Server. type: array items: "$ref": "#/components/schemas/AIGatewayMCPConversionTool" minItems: 1 display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - type - config - tools - display_name - name - id - created_at - updated_at title: AIGatewayMCPServerConversionOnlyResponse AIGatewayMCPServerConversionListenerResponse: type: object properties: type: type: string enum: - conversion-listener x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerWithUpstreamNoProxyConfig" tools: description: | List of tools exposed by this MCP Server. Each tool's `path`, `method`, and `host` describe the backend HTTP operation on the upstream selected by `config.url` — they do not need to match the public MCP Route configured in `config.route`. type: array items: "$ref": "#/components/schemas/AIGatewayMCPConversionTool" minItems: 1 access: "$ref": "#/components/schemas/AIGatewayMCPServerListenerAccess" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - type - config - tools - display_name - name - id - created_at - updated_at title: AIGatewayMCPServerConversionListenerResponse AIGatewayMCPServerListenerResponse: type: object properties: type: type: string enum: - listener x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerNoUpstreamConfig" sources: description: | The explicit list of source MCP Servers whose tools this listener exposes. Each entry is the immutable `name` of a `conversion-only` (toolset) or `upstream-server` (third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. type: array items: "$ref": "#/components/schemas/AIGatewayEntityIdentifier" example: - kongair-flights - github-mcp minItems: 1 access: "$ref": "#/components/schemas/AIGatewayMCPServerListenerAccess" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - type - config - sources - display_name - name - id - created_at - updated_at title: AIGatewayMCPServerListenerResponse AIGatewayMCPServerPassthroughListenerResponse: type: object properties: type: type: string enum: - passthrough-listener x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerWithUpstreamConfig" tools: description: | Per-tool access-control overrides for tools advertised by the remote MCP Server. Each entry is matched to a remote tool by `name`; only its access-control rules are applied. type: array items: "$ref": "#/components/schemas/AIGatewayMCPPassthroughTool" access: "$ref": "#/components/schemas/AIGatewayMCPServerListenerAccess" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - type - config - display_name - name - id - created_at - updated_at title: AIGatewayMCPServerPassthroughListenerResponse AIGatewayMCPServerUpstreamServerResponse: type: object properties: type: type: string enum: - upstream-server x-terraform-transform-const: true config: "$ref": "#/components/schemas/AIGatewayMCPServerUpstreamServerConfig" tools: description: 'List of tools exposed by this MCP Server. ' type: array items: "$ref": "#/components/schemas/AIGatewayMCPUpstreamTool" display_name: description: The display name for the MCP Server. type: string example: Kong Air Flights maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation. example: kongair-flights allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" enabled: description: Whether the MCP Server is enabled. type: boolean example: true default: true policies: "$ref": "#/components/schemas/AIGatewayPolicyReferences" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - type - config - display_name - name - id - created_at - updated_at title: AIGatewayMCPServerUpstreamServerResponse AIGatewayMCPUpstreamTool: description: | A tool exposed by an MCP Server in `upstream-server` mode. Provides optional metadata overrides (`description`, `annotations`, `input_schema`, `output_schema`) and per-tool ACLs for a tool advertised by the upstream MCP server; any field not overridden here falls back to the remote tool's own definition. type: object properties: access: "$ref": "#/components/schemas/AIGatewayMCPToolAccess" annotations: "$ref": "#/components/schemas/AIGatewayMCPToolAnnotations" description: description: A description of what the tool does. type: string example: Search for available flights name: description: The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. type: string input_schema: description: | The entire `inputSchema` section for the tool. Overrides the upstream server's `inputSchema` for the same tool name, if present. type: object additionalProperties: true nullable: true output_schema: description: | The entire `outputSchema` section for the tool. Overrides the upstream server's `outputSchema` for the same tool name, if present. type: object additionalProperties: true nullable: true additionalProperties: false required: - name AIGatewayMCPToolAnnotations: type: object properties: destructive_hint: description: If true, the tool may perform destructive updates type: boolean idempotent_hint: description: If true, repeated calls with same args have no additional effect type: boolean open_world_hint: description: If true, tool interacts with external entities type: boolean read_only_hint: description: If true, the tool does not modify its environment type: boolean title: description: Human-readable title for the tool type: string additionalProperties: false AIGatewayMCPToolHeaders: description: The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. type: object additionalProperties: true AIGatewayMCPToolQuery: description: The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. type: object additionalProperties: true AIGatewayMCPToolRequestBody: description: The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported. type: object additionalProperties: true AIGatewayMCPToolResponses: description: The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported. type: object additionalProperties: true AIGatewayMCPToolParameters: type: array items: "$ref": "#/components/schemas/AIGatewayMCPToolParameter" AIGatewayMCPToolParameter: description: 'An API parameter specification defined in OpenAPI JSON format. For example, ''[{"name": "city", "in": "query", "description": "Name of the city to get the weather for", "required": true, "schema": {"type": "string"}}]''. See https://swagger.io/docs/specification/v3_0/describing-parameters/ for more details.' type: object properties: name: description: The name of the parameter. type: string example: origin in: description: The location of the parameter in the request. type: string example: query enum: - query - path - header - body description: description: A description of the parameter. type: string example: The origin airport code. required: description: Whether this parameter is required. type: boolean example: true schema: description: JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details. type: object additionalProperties: true additionalProperties: false required: - name - in AIGatewayIdentityProviderReference: description: Reference to a identity provider instance by name. type: string example: okta-ai-se deprecated: true AIGatewayIdentityProviderKeyAuth: description: Configuration for an identity provider. type: object properties: display_name: description: The display name for this identity provider instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this identity provider instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - key-auth x-terraform-transform-const: true config: description: | Configuration for the Kong Key auth identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/key-auth/reference/ for the list of properties type: object additionalProperties: true properties: hide_credentials: description: | An optional boolean value telling the plugin to show or hide the credential from the upstream service. If true, the plugin strips the credential from the request. type: boolean default: true key_in_body: description: | If enabled, reads the request body. Supported MIME types: application/www-form-urlencoded, application/json, and multipart/form-data. type: boolean default: false key_in_header: description: 'If enabled (default), the plugin reads the request header and tries to find the key in it. ' type: boolean default: true key_in_query: description: 'If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. ' type: boolean default: true key_names: description: 'An array of strings containing the names of the keys to look for in the request. ' type: array items: type: string default: - apikey principals: description: | Authenticate against Kong Identity instead of local credentials. Mutually exclusive with identity realms. type: object properties: enabled: description: When true, authenticate against Kong Identity instead of local credentials. type: boolean default: false directory: description: The Kong Identity directory instance to authenticate against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" error_on_miss: description: | When true (default), reject the request if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. type: boolean default: true deprecated: true required: - display_name - name - type title: AIGatewayIdentityProviderKeyAuthConfig AIGatewayIdentityProviderOpenIDConnect: description: Configuration for an identity provider. type: object properties: display_name: description: The display name for this identity provider instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this identity provider instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - openid-connect x-terraform-transform-const: true config: description: | Configuration for the OpenID Connect identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/openid-connect/reference/ for the list of properties type: object additionalProperties: true properties: auth_methods: description: Types of credentials/grants to enable. type: array items: type: string enum: - authorization_code - bearer - client_credentials - introspection - kong_oauth2 - password - refresh_token - session - userinfo default: - bearer - client_credentials client_id: description: | An array of strings representing the client id for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string client_secret: description: | An array of strings representing the client secret for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string writeOnly: true client_alg: description: Algorithm to use for `client_secret_jwt` or `private_key_jwt` authentication. type: array items: type: string enum: - HS256 - HS384 - HS512 - RS256 - RS384 - RS512 - ES256 - ES384 - ES512 - PS256 - PS384 - PS512 - EdDSA client_auth: description: Client authentication methods used with the identity provider. type: array items: type: string enum: - client_secret_basic - client_secret_post - client_secret_jwt - private_key_jwt - tls_client_auth - self_signed_tls_client_auth - none consumer_claims: description: | An array containing an array of string paths representing the location of the claim in a nested object. For example, to map to user.info.id, set [ "user", "info", "id" ]. type: array items: type: array items: type: string consumer_groups_claim: description: | The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload. type: array items: type: string consumer_groups_optional: description: 'Do not terminate the request if consumer groups mapping fails. ' type: boolean default: false consumer_by: description: Consumer fields used when mapping a token claim to a Kong consumer. type: array items: type: string enum: - id - username - custom_id default: - username - custom_id consumer_optional: description: 'Do not terminate the request if consumer mapping fails. ' type: boolean default: false credential_claim: description: Claim path used to derive virtual credentials when consumer mapping is not used. type: array items: type: string default: - sub issuer: description: URL that identifies the OpenID Provider type: string example: https://dev-123456.okta.com introspection_endpoint: description: Overrides the introspection endpoint returned by discovery. type: string format: uri x-referenceable: true mtls_introspection_endpoint: description: mTLS alias for the introspection endpoint. type: string format: uri cache_introspection: description: Cache introspection endpoint requests. type: boolean default: true jwks_endpoint: description: Overrides the JWKS endpoint returned by discovery. type: string format: uri leeway: description: Leeway, in seconds, for validating token time claims. type: integer default: 0 minimum: 0 scopes: description: 'This field is referenceable. ' type: array items: type: string default: - openid audience_required: description: Audiences required in the access token or introspection response. type: array items: type: string ssl_verify: type: boolean default: true hide_credentials: description: Remove credentials used for authentication before proxying the request upstream. type: boolean default: true keepalive: description: Reuse HTTP client connections for identity provider requests. type: boolean default: true timeout: description: Network I/O timeout, in milliseconds, for identity provider requests. type: integer default: 10000 minimum: 0 http_version: description: HTTP version used for identity provider requests. type: number default: 1.1 enum: - 1 - 1.1 http_proxy: description: HTTP proxy used for identity provider requests. type: string format: uri http_proxy_authorization: description: Authorization header value sent to the HTTP proxy. type: string writeOnly: true https_proxy: description: HTTPS proxy used for identity provider requests. type: string format: uri https_proxy_authorization: description: Authorization header value sent to the HTTPS proxy. type: string writeOnly: true no_proxy: description: Comma-separated hosts that bypass the configured proxies. type: string upstream_headers: description: Map token claims to upstream headers using path-based access. type: array items: type: object required: - header - path properties: header: description: The name of the header. type: string path: description: The path of the header value. type: array items: type: string minItems: 1 cache_tokens_salt: description: 'Salt used for generating the cache key that is used for caching the token endpoint requests. ' type: string principals: description: Map a request to a Kong Identity principal after token verification. type: object properties: enabled: description: When true, look up a Kong Identity principal after token verification. type: boolean default: false directory: description: The Kong Identity directory instance to look up against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" principal_by: description: | Custom identity name for a custom Kong Identity lookup. When absent and principal_claim is set, a lookup is performed using principal_claim as the claim name instead of the default sub claim. type: string minLength: 1 principal_claim: description: | Token claim used for the Kong Identity lookup. If multiple values are set, the claim is inside a nested object of the token payload. Used together with, or instead of, principal_by. type: array items: type: string minLength: 1 minItems: 1 match_consumer: description: | If a consumer is attached to the matched principal, load it and set it in the request context, overriding consumer_by. type: boolean default: true match_consumer_groups: description: 'If consumer groups are attached to the matched principal, load them, overriding consumer_groups_claim. ' type: boolean default: true error_on_miss: description: | When true (default), reject the request if no principal is matched in Kong Identity after token verification. When false, the request continues without an authenticated principal set. type: boolean default: true required: - cache_tokens_salt deprecated: true required: - display_name - name - type title: AIGatewayIdentityProviderOpenIDConnectConfig AIGatewayAuthStrategyReference: description: Reference to an auth strategy instance by name. type: string example: okta-ai-se AIGatewayAuthStrategyKeyAuth: description: Configuration for an auth strategy. type: object properties: display_name: description: The display name for this auth strategy instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - key-auth x-terraform-transform-const: true config: description: | Configuration for the key-auth auth strategy. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/key-auth/reference/ for the list of properties type: object additionalProperties: true properties: hide_credentials: description: | An optional boolean value telling the plugin to show or hide the credential from the upstream service. If true, the plugin strips the credential from the request. type: boolean default: true key_in_body: description: | If enabled, reads the request body. Supported MIME types: application/www-form-urlencoded, application/json, and multipart/form-data. type: boolean default: false key_in_header: description: 'If enabled (default), the plugin reads the request header and tries to find the key in it. ' type: boolean default: true key_in_query: description: 'If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. ' type: boolean default: true key_names: description: 'An array of strings containing the names of the keys to look for in the request. ' type: array items: type: string default: - apikey principals: description: | Authenticate against Kong Identity instead of local credentials. Mutually exclusive with identity realms. type: object properties: enabled: description: When true, authenticate against Kong Identity instead of local credentials. type: boolean default: false directory: description: The Kong Identity directory instance to authenticate against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" error_on_miss: description: | When true (default), reject the request if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. type: boolean default: true required: - display_name - name - type title: AIGatewayAuthStrategyKeyAuthConfig AIGatewayAuthStrategyOpenIDConnect: description: Configuration for an auth strategy. type: object properties: display_name: description: The display name for this auth strategy instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - openid-connect x-terraform-transform-const: true config: description: | Configuration for the OpenID Connect auth strategy. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/openid-connect/reference/ for the list of properties type: object additionalProperties: true properties: auth_methods: description: Types of credentials/grants to enable. type: array items: type: string enum: - authorization_code - bearer - client_credentials - introspection - kong_oauth2 - password - refresh_token - session - userinfo default: - bearer - client_credentials client_id: description: | An array of strings representing the client id for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string client_secret: description: | An array of strings representing the client secret for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string writeOnly: true client_alg: description: Algorithm to use for `client_secret_jwt` or `private_key_jwt` authentication. type: array items: type: string enum: - HS256 - HS384 - HS512 - RS256 - RS384 - RS512 - ES256 - ES384 - ES512 - PS256 - PS384 - PS512 - EdDSA client_auth: description: Client authentication methods used with the identity provider. type: array items: type: string enum: - client_secret_basic - client_secret_post - client_secret_jwt - private_key_jwt - tls_client_auth - self_signed_tls_client_auth - none consumer_claims: description: | An array containing an array of string paths representing the location of the claim in a nested object. For example, to map to user.info.id, set [ "user", "info", "id" ]. type: array items: type: array items: type: string consumer_groups_claim: description: | The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload. type: array items: type: string consumer_groups_optional: description: 'Do not terminate the request if consumer groups mapping fails. ' type: boolean default: false consumer_by: description: Consumer fields used when mapping a token claim to a Kong consumer. type: array items: type: string enum: - id - username - custom_id default: - username - custom_id consumer_optional: description: 'Do not terminate the request if consumer mapping fails. ' type: boolean default: false credential_claim: description: Claim path used to derive virtual credentials when consumer mapping is not used. type: array items: type: string default: - sub issuer: description: URL that identifies the OpenID Provider type: string example: https://dev-123456.okta.com introspection_endpoint: description: Overrides the introspection endpoint returned by discovery. type: string format: uri x-referenceable: true mtls_introspection_endpoint: description: mTLS alias for the introspection endpoint. type: string format: uri cache_introspection: description: Cache introspection endpoint requests. type: boolean default: true jwks_endpoint: description: Overrides the JWKS endpoint returned by discovery. type: string format: uri leeway: description: Leeway, in seconds, for validating token time claims. type: integer default: 0 minimum: 0 scopes: description: 'This field is referenceable. ' type: array items: type: string default: - openid audience_required: description: Audiences required in the access token or introspection response. type: array items: type: string ssl_verify: type: boolean default: true hide_credentials: description: Remove credentials used for authentication before proxying the request upstream. type: boolean default: true keepalive: description: Reuse HTTP client connections for identity provider requests. type: boolean default: true timeout: description: Network I/O timeout, in milliseconds, for identity provider requests. type: integer default: 10000 minimum: 0 http_version: description: HTTP version used for identity provider requests. type: number default: 1.1 enum: - 1 - 1.1 http_proxy: description: HTTP proxy used for identity provider requests. type: string format: uri http_proxy_authorization: description: Authorization header value sent to the HTTP proxy. type: string writeOnly: true https_proxy: description: HTTPS proxy used for identity provider requests. type: string format: uri https_proxy_authorization: description: Authorization header value sent to the HTTPS proxy. type: string writeOnly: true no_proxy: description: Comma-separated hosts that bypass the configured proxies. type: string upstream_headers: description: Map token claims to upstream headers using path-based access. type: array items: type: object required: - header - path properties: header: description: The name of the header. type: string path: description: The path of the header value. type: array items: type: string minItems: 1 cache_tokens_salt: description: 'Salt used for generating the cache key that is used for caching the token endpoint requests. ' type: string principals: description: Map a request to a Kong Identity principal after token verification. type: object properties: enabled: description: When true, look up a Kong Identity principal after token verification. type: boolean default: false directory: description: The Kong Identity directory instance to look up against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" principal_by: description: | Custom identity name for a custom Kong Identity lookup. When absent and principal_claim is set, a lookup is performed using principal_claim as the claim name instead of the default sub claim. type: string minLength: 1 principal_claim: description: | Token claim used for the Kong Identity lookup. If multiple values are set, the claim is inside a nested object of the token payload. Used together with, or instead of, principal_by. type: array items: type: string minLength: 1 minItems: 1 match_consumer: description: | If a consumer is attached to the matched principal, load it and set it in the request context, overriding consumer_by. type: boolean default: true match_consumer_groups: description: 'If consumer groups are attached to the matched principal, load them, overriding consumer_groups_claim. ' type: boolean default: true error_on_miss: description: | When true (default), reject the request if no principal is matched in Kong Identity after token verification. When false, the request continues without an authenticated principal set. type: boolean default: true required: - cache_tokens_salt required: - display_name - name - type title: AIGatewayAuthStrategyOpenIDConnectConfig AIGatewayModelProviderReference: description: Reference to a model provider instance by name. type: string example: azure-ai-se AIGatewayModelProviderAnthropic: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - anthropic x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderCerebras: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - cerebras x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderCohere: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - cohere x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderDashscope: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - dashscope x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderDatabricks: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - databricks x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderDeepseek: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - deepseek x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderHuggingface: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - huggingface x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderKimi: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - kimi x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderLlama2: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - llama2 x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderMistral: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - mistral x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderOllama: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - ollama x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderOpenai: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - openai x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderVercel: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - vercel x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderVllm: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - vllm x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderXai: description: 'Configuration for an upstream model provider. ' type: object properties: type: type: string enum: - xai x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: description: Configuration for the model provider. type: object additionalProperties: false properties: auth: "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" required: - auth required: - type - display_name - name - config AIGatewayModelProviderConfigAuthBasic: description: 'Basic auth config for an upstream model provider. ' type: object properties: type: type: string enum: - basic x-terraform-transform-const: true headers: type: array items: type: object additionalProperties: false required: - name properties: name: description: | The name of the header used for authentication. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true value: description: | The auth header value for ‘header_name’, for example ‘Bearer key...’. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true maxItems: 1 params: type: array items: type: object additionalProperties: false required: - name properties: name: description: 'This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). ' type: string x-referenceable: true value: description: 'This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). ' type: string writeOnly: true x-referenceable: true location: description: Specify whether the param name and value options go in a query string, or the POST form/JSON body. type: string enum: - body - query maxItems: 1 additionalProperties: false required: - type title: AIGatewayModelProviderConfigAuthBasic AIGatewayModelProviderBedrock: description: 'Config for AWS model provider. ' type: object properties: type: type: string enum: - bedrock x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: type: object additionalProperties: false properties: auth: discriminator: propertyName: type mapping: basic: "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" aws: "#/components/schemas/AIGatewayModelProviderConfigAuthAWS" oneOf: - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthAWS" required: - auth required: - type - display_name - name - config AIGatewayModelProviderConfigAuthAWS: description: 'Configuration for AWS model provider. ' type: object properties: type: type: string enum: - aws x-terraform-transform-const: true access_key_id: description: | The access key id for authenticating with static IAM User credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true secret_access_key: description: | The secret access key for authenticating with static IAM User credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true session_token: description: | The session token for authenticating with temporary IAM credentials (issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the `X-Amz-Security-Token` header. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true assume_role_arn: description: | The ARN of the IAM role to assume for generating authentication tokens. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true role_session_name: description: | The session name for the temporary credentials when assuming the IAM role. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true sts_endpoint_url: description: The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used. type: string batch_role_arn: description: AWS role arn to use when calling the batch API. type: string required: - type title: AIGatewayModelProviderConfigAuthAWS AIGatewayUpstreamConfig: description: Configuration applied when proxying to the upstream service, including authentication. type: object properties: auth: description: Authentication to use when proxying to the upstream service. discriminator: propertyName: type mapping: aws: "#/components/schemas/AIGatewayUpstreamAuthAWS" oneOf: - "$ref": "#/components/schemas/AIGatewayUpstreamAuthAWS" additionalProperties: false AIGatewayUpstreamAuthAWS: description: 'AWS IAM (SigV4) authentication for the upstream service. ' type: object properties: type: type: string enum: - aws x-terraform-transform-const: true access_key_id: description: | The access key id for authenticating with static IAM User credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true secret_access_key: description: | The secret access key for authenticating with static IAM User credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true session_token: description: | The session token for authenticating with temporary IAM credentials. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true region: description: 'The AWS region of the upstream service. Overrides the region inferred from the environment. ' type: string assume_role_arn: description: | The ARN of the IAM role to assume for generating authentication tokens. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true role_session_name: description: | The session name for the temporary credentials when assuming the IAM role. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true sts_endpoint_url: description: | The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used. type: string example: type: aws region: us-east-1 access_key_id: AKIAIOSFODNN7EXAMPLE required: - type title: AIGatewayUpstreamAuthAWS AIGatewayModelProviderAzure: description: 'Config for Azure model provider. ' type: object properties: type: type: string enum: - azure x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: type: object additionalProperties: false properties: auth: discriminator: propertyName: type mapping: basic: "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" azure: "#/components/schemas/AIGatewayModelProviderConfigAuthAzure" oneOf: - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthAzure" service: description: | Selects the Azure backend for this provider instance. Use `azure-openai` for Azure OpenAI deployments or `azure-foundry` for Azure AI Foundry. type: string default: azure-openai enum: - azure-openai - azure-foundry instance: description: 'The Azure OpenAI instance name. Required when `service` is `azure-openai`. ' type: string example: kong-az-east foundry: description: | Endpoint configuration for Azure AI Foundry hosted models. Required when `service` is `azure-foundry`. type: object additionalProperties: false properties: resource: description: The Azure AI Foundry resource name. type: string example: kong-foundry-east domain: description: The domain for Azure AI Foundry hosted models. type: string default: services.ai.azure.com required: - resource required: - auth required: - type - display_name - name - config AIGatewayModelProviderConfigAuthAzure: description: 'Configuration for Azure model provider. ' type: object properties: type: type: string enum: - azure x-terraform-transform-const: true client_id: description: | If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true client_secret: description: | If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true tenant_id: description: | If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true use_managed_identity: description: Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models. type: boolean additionalProperties: false required: - type title: AIGatewayModelProviderConfigAuthAzure AIGatewayModelProviderGemini: description: 'Config for GCP model provider. ' type: object properties: type: type: string enum: - gemini x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: type: object additionalProperties: false properties: auth: discriminator: propertyName: type mapping: basic: "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" gcp: "#/components/schemas/AIGatewayModelProviderConfigAuthGCP" oneOf: - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthGCP" required: - auth required: - type - display_name - name - config AIGatewayModelProviderConfigAuthGCP: description: 'Configuration for GCP model provider. ' type: object properties: type: type: string enum: - gcp x-terraform-transform-const: true service_account_json: description: | Full JSON string of the GCP service account to authenticate. If not set (and gcp_use_service_account is true), the service account JSON will be from the environment variable GCP_SERVICE_ACCOUNT. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true metadata_url: description: | Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If not set, Kong will use the default Google metadata endpoint. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true oauth_token_url: description: | Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If not set, Kong will use the default Google OAuth token endpoint. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string x-referenceable: true use_gcp_service_account: description: Use service account auth for GCP-based providers and models. type: boolean workload_identity_federation: "$ref": "#/components/schemas/AuthGCPWorkloadIdentityFederation" additionalProperties: false required: - type title: AIGatewayModelProviderConfigAuthGCP AuthGCPWorkloadIdentityFederation: description: 'Config for GCP Workload Identity Federation. ' discriminator: propertyName: source mapping: aws_iam: "#/components/schemas/AuthGCPWorkloadIdentityFederationAwsIam" oneOf: - "$ref": "#/components/schemas/AuthGCPWorkloadIdentityFederationAwsIam" title: AuthGCPWorkloadIdentityFederation AuthGCPWorkloadIdentityFederationAwsIam: description: | Enables authenticating with GCP via Workload Identity Federation, obtaining temporary GCP credentials instead of using a static service account key. type: object properties: source: description: 'The source identity provider/system used to obtain temporary GCP credentials. ' type: string enum: - aws_iam auth_json: description: | JSON configuration for the Workload Identity Federation token exchange (Google's `external_account` credential config: audience, token URL, credential source, and optional service account impersonation URL). If not set, Kong falls back to the file path in the `GOOGLE_APPLICATION_CREDENTIALS` environment variable. This field is [referenceable](https://developer.konghq.com/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault). type: string writeOnly: true x-referenceable: true aws: "$ref": "#/components/schemas/AIGatewayUpstreamAuthAWS" additionalProperties: false required: - source title: AuthGCPWorkloadIdentityFederationAwsIam AIGatewayModelProviderSagemaker: description: 'Config for Sagemaker model provider. ' type: object properties: type: type: string enum: - sagemaker x-terraform-transform-const: true display_name: description: The display name for this model provider instance. type: string example: Azure AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this model provider instance, used as a stable human-readable reference. This value is immutable after creation. example: azure-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" config: type: object additionalProperties: false properties: auth: discriminator: propertyName: type mapping: basic: "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" sagemaker: "#/components/schemas/AIGatewayModelProviderConfigAuthSagemaker" oneOf: - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthBasic" - "$ref": "#/components/schemas/AIGatewayModelProviderConfigAuthSagemaker" required: - auth required: - type - display_name - name - config AIGatewayModelProviderConfigAuthSagemaker: description: 'Auth configuration for Sagemaker model provider. ' type: object properties: type: type: string enum: - sagemaker aws: type: object additionalProperties: false properties: access_key_id: description: static IAM user credential; overrides AWS_ACCESS_KEY_ID env var type: string secret_access_key: description: static IAM user credential; overrides AWS_SECRET_ACCESS_KEY env var type: string writeOnly: true session_token: description: static IAM user credential; overrides AWS_SESSION_TOKEN env var type: string writeOnly: true additionalProperties: false required: - type title: AIGatewayModelProviderConfigAuthSagemaker CreateAIGatewayConfigStoreRequest: type: object properties: display_name: description: The display name of the Config Store. type: string example: my-config-store maxLength: 256 pattern: "^[a-zA-Z0-9.\\-_~]*$" name: description: The name of the Config Store. This value is immutable after creation. example: my-config-store allOf: - "$ref": "#/components/schemas/AIGatewayConfigStoreName" additionalProperties: false required: - name UpdateAIGatewayConfigStoreRequest: type: object properties: display_name: description: The display name of the Config Store. type: string example: MyConfigStore labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" additionalProperties: false AIGatewayConfigStore: type: object properties: display_name: description: The display name of the Config Store. type: string example: my-config-store maxLength: 256 pattern: "^[a-zA-Z0-9.\\-_~]*$" name: description: The name of the Config Store. This value is immutable after creation. example: my-config-store allOf: - "$ref": "#/components/schemas/AIGatewayConfigStoreName" id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - name - id - created_at - updated_at AIGatewayConfigStoreSecretKey: description: The unique key identifying the secret within the Config Store. type: string example: my-secret-key maxLength: 512 minLength: 1 AIGatewayConfigStoreSecretValue: description: The secret value. Once stored, this value cannot be retrieved. type: string example: my-secret-value maxLength: 5120 writeOnly: true CreateAIGatewayConfigStoreSecretRequest: type: object properties: key: "$ref": "#/components/schemas/AIGatewayConfigStoreSecretKey" value: "$ref": "#/components/schemas/AIGatewayConfigStoreSecretValue" additionalProperties: false required: - key - value UpdateAIGatewayConfigStoreSecretRequest: type: object properties: value: "$ref": "#/components/schemas/AIGatewayConfigStoreSecretValue" additionalProperties: false required: - value AIGatewayConfigStoreSecret: type: object properties: key: "$ref": "#/components/schemas/AIGatewayConfigStoreSecretKey" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" additionalProperties: false required: - key - created_at - updated_at CreateAIGatewayModelProviderRequest: discriminator: propertyName: type mapping: anthropic: "#/components/schemas/AIGatewayModelProviderAnthropic" azure: "#/components/schemas/AIGatewayModelProviderAzure" bedrock: "#/components/schemas/AIGatewayModelProviderBedrock" cerebras: "#/components/schemas/AIGatewayModelProviderCerebras" cohere: "#/components/schemas/AIGatewayModelProviderCohere" dashscope: "#/components/schemas/AIGatewayModelProviderDashscope" databricks: "#/components/schemas/AIGatewayModelProviderDatabricks" deepseek: "#/components/schemas/AIGatewayModelProviderDeepseek" gemini: "#/components/schemas/AIGatewayModelProviderGemini" huggingface: "#/components/schemas/AIGatewayModelProviderHuggingface" kimi: "#/components/schemas/AIGatewayModelProviderKimi" llama2: "#/components/schemas/AIGatewayModelProviderLlama2" mistral: "#/components/schemas/AIGatewayModelProviderMistral" ollama: "#/components/schemas/AIGatewayModelProviderOllama" openai: "#/components/schemas/AIGatewayModelProviderOpenai" vercel: "#/components/schemas/AIGatewayModelProviderVercel" vllm: "#/components/schemas/AIGatewayModelProviderVllm" xai: "#/components/schemas/AIGatewayModelProviderXai" sagemaker: "#/components/schemas/AIGatewayModelProviderSagemaker" oneOf: - "$ref": "#/components/schemas/AIGatewayModelProviderAnthropic" - "$ref": "#/components/schemas/AIGatewayModelProviderAzure" - "$ref": "#/components/schemas/AIGatewayModelProviderBedrock" - "$ref": "#/components/schemas/AIGatewayModelProviderCerebras" - "$ref": "#/components/schemas/AIGatewayModelProviderCohere" - "$ref": "#/components/schemas/AIGatewayModelProviderDashscope" - "$ref": "#/components/schemas/AIGatewayModelProviderDatabricks" - "$ref": "#/components/schemas/AIGatewayModelProviderDeepseek" - "$ref": "#/components/schemas/AIGatewayModelProviderGemini" - "$ref": "#/components/schemas/AIGatewayModelProviderHuggingface" - "$ref": "#/components/schemas/AIGatewayModelProviderKimi" - "$ref": "#/components/schemas/AIGatewayModelProviderLlama2" - "$ref": "#/components/schemas/AIGatewayModelProviderMistral" - "$ref": "#/components/schemas/AIGatewayModelProviderOllama" - "$ref": "#/components/schemas/AIGatewayModelProviderOpenai" - "$ref": "#/components/schemas/AIGatewayModelProviderVercel" - "$ref": "#/components/schemas/AIGatewayModelProviderVllm" - "$ref": "#/components/schemas/AIGatewayModelProviderXai" - "$ref": "#/components/schemas/AIGatewayModelProviderSagemaker" UpdateAIGatewayModelProviderRequest: discriminator: propertyName: type mapping: anthropic: "#/components/schemas/AIGatewayModelProviderAnthropic" azure: "#/components/schemas/AIGatewayModelProviderAzure" bedrock: "#/components/schemas/AIGatewayModelProviderBedrock" cerebras: "#/components/schemas/AIGatewayModelProviderCerebras" cohere: "#/components/schemas/AIGatewayModelProviderCohere" dashscope: "#/components/schemas/AIGatewayModelProviderDashscope" databricks: "#/components/schemas/AIGatewayModelProviderDatabricks" deepseek: "#/components/schemas/AIGatewayModelProviderDeepseek" gemini: "#/components/schemas/AIGatewayModelProviderGemini" huggingface: "#/components/schemas/AIGatewayModelProviderHuggingface" kimi: "#/components/schemas/AIGatewayModelProviderKimi" llama2: "#/components/schemas/AIGatewayModelProviderLlama2" mistral: "#/components/schemas/AIGatewayModelProviderMistral" ollama: "#/components/schemas/AIGatewayModelProviderOllama" openai: "#/components/schemas/AIGatewayModelProviderOpenai" vercel: "#/components/schemas/AIGatewayModelProviderVercel" vllm: "#/components/schemas/AIGatewayModelProviderVllm" xai: "#/components/schemas/AIGatewayModelProviderXai" sagemaker: "#/components/schemas/AIGatewayModelProviderSagemaker" oneOf: - "$ref": "#/components/schemas/AIGatewayModelProviderAnthropic" - "$ref": "#/components/schemas/AIGatewayModelProviderAzure" - "$ref": "#/components/schemas/AIGatewayModelProviderBedrock" - "$ref": "#/components/schemas/AIGatewayModelProviderCerebras" - "$ref": "#/components/schemas/AIGatewayModelProviderCohere" - "$ref": "#/components/schemas/AIGatewayModelProviderDashscope" - "$ref": "#/components/schemas/AIGatewayModelProviderDatabricks" - "$ref": "#/components/schemas/AIGatewayModelProviderDeepseek" - "$ref": "#/components/schemas/AIGatewayModelProviderGemini" - "$ref": "#/components/schemas/AIGatewayModelProviderHuggingface" - "$ref": "#/components/schemas/AIGatewayModelProviderKimi" - "$ref": "#/components/schemas/AIGatewayModelProviderLlama2" - "$ref": "#/components/schemas/AIGatewayModelProviderMistral" - "$ref": "#/components/schemas/AIGatewayModelProviderOllama" - "$ref": "#/components/schemas/AIGatewayModelProviderOpenai" - "$ref": "#/components/schemas/AIGatewayModelProviderVercel" - "$ref": "#/components/schemas/AIGatewayModelProviderVllm" - "$ref": "#/components/schemas/AIGatewayModelProviderXai" - "$ref": "#/components/schemas/AIGatewayModelProviderSagemaker" AIGatewayModelProvider: type: object properties: id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" discriminator: propertyName: type mapping: anthropic: "#/components/schemas/AIGatewayModelProviderAnthropic" azure: "#/components/schemas/AIGatewayModelProviderAzure" bedrock: "#/components/schemas/AIGatewayModelProviderBedrock" cerebras: "#/components/schemas/AIGatewayModelProviderCerebras" cohere: "#/components/schemas/AIGatewayModelProviderCohere" dashscope: "#/components/schemas/AIGatewayModelProviderDashscope" databricks: "#/components/schemas/AIGatewayModelProviderDatabricks" deepseek: "#/components/schemas/AIGatewayModelProviderDeepseek" gemini: "#/components/schemas/AIGatewayModelProviderGemini" huggingface: "#/components/schemas/AIGatewayModelProviderHuggingface" kimi: "#/components/schemas/AIGatewayModelProviderKimi" llama2: "#/components/schemas/AIGatewayModelProviderLlama2" mistral: "#/components/schemas/AIGatewayModelProviderMistral" ollama: "#/components/schemas/AIGatewayModelProviderOllama" openai: "#/components/schemas/AIGatewayModelProviderOpenai" vercel: "#/components/schemas/AIGatewayModelProviderVercel" vllm: "#/components/schemas/AIGatewayModelProviderVllm" xai: "#/components/schemas/AIGatewayModelProviderXai" sagemaker: "#/components/schemas/AIGatewayModelProviderSagemaker" oneOf: - "$ref": "#/components/schemas/AIGatewayModelProviderAnthropic" - "$ref": "#/components/schemas/AIGatewayModelProviderAzure" - "$ref": "#/components/schemas/AIGatewayModelProviderBedrock" - "$ref": "#/components/schemas/AIGatewayModelProviderCerebras" - "$ref": "#/components/schemas/AIGatewayModelProviderCohere" - "$ref": "#/components/schemas/AIGatewayModelProviderDashscope" - "$ref": "#/components/schemas/AIGatewayModelProviderDatabricks" - "$ref": "#/components/schemas/AIGatewayModelProviderDeepseek" - "$ref": "#/components/schemas/AIGatewayModelProviderGemini" - "$ref": "#/components/schemas/AIGatewayModelProviderHuggingface" - "$ref": "#/components/schemas/AIGatewayModelProviderKimi" - "$ref": "#/components/schemas/AIGatewayModelProviderLlama2" - "$ref": "#/components/schemas/AIGatewayModelProviderMistral" - "$ref": "#/components/schemas/AIGatewayModelProviderOllama" - "$ref": "#/components/schemas/AIGatewayModelProviderOpenai" - "$ref": "#/components/schemas/AIGatewayModelProviderVercel" - "$ref": "#/components/schemas/AIGatewayModelProviderVllm" - "$ref": "#/components/schemas/AIGatewayModelProviderXai" - "$ref": "#/components/schemas/AIGatewayModelProviderSagemaker" required: - id - created_at - updated_at CreateAIGatewayIdentityProviderRequest: deprecated: true discriminator: propertyName: type mapping: key-auth: "#/components/schemas/AIGatewayIdentityProviderKeyAuth" openid-connect: "#/components/schemas/AIGatewayIdentityProviderOpenIDConnect" oneOf: - "$ref": "#/components/schemas/AIGatewayIdentityProviderKeyAuth" - "$ref": "#/components/schemas/AIGatewayIdentityProviderOpenIDConnect" UpdateAIGatewayIdentityProviderRequest: deprecated: true discriminator: propertyName: type mapping: key-auth: "#/components/schemas/AIGatewayIdentityProviderKeyAuth" openid-connect: "#/components/schemas/AIGatewayIdentityProviderOpenIDConnect" oneOf: - "$ref": "#/components/schemas/AIGatewayIdentityProviderKeyAuth" - "$ref": "#/components/schemas/AIGatewayIdentityProviderOpenIDConnect" AIGatewayIdentityProvider: deprecated: true discriminator: propertyName: type mapping: key-auth: "#/components/schemas/AIGatewayIdentityProviderKeyAuthResponse" openid-connect: "#/components/schemas/AIGatewayIdentityProviderOpenIDConnectResponse" oneOf: - "$ref": "#/components/schemas/AIGatewayIdentityProviderKeyAuthResponse" - "$ref": "#/components/schemas/AIGatewayIdentityProviderOpenIDConnectResponse" AIGatewayIdentityProviderKeyAuthResponse: description: Configuration for an identity provider. type: object properties: display_name: description: The display name for this identity provider instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this identity provider instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - key-auth x-terraform-transform-const: true config: description: | Configuration for the Kong Key auth identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/key-auth/reference/ for the list of properties type: object additionalProperties: true properties: hide_credentials: description: | An optional boolean value telling the plugin to show or hide the credential from the upstream service. If true, the plugin strips the credential from the request. type: boolean default: true key_in_body: description: | If enabled, reads the request body. Supported MIME types: application/www-form-urlencoded, application/json, and multipart/form-data. type: boolean default: false key_in_header: description: 'If enabled (default), the plugin reads the request header and tries to find the key in it. ' type: boolean default: true key_in_query: description: 'If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. ' type: boolean default: true key_names: description: 'An array of strings containing the names of the keys to look for in the request. ' type: array items: type: string default: - apikey principals: description: | Authenticate against Kong Identity instead of local credentials. Mutually exclusive with identity realms. type: object properties: enabled: description: When true, authenticate against Kong Identity instead of local credentials. type: boolean default: false directory: description: The Kong Identity directory instance to authenticate against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" error_on_miss: description: | When true (default), reject the request if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. type: boolean default: true id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" deprecated: true required: - display_name - name - type - id - created_at - updated_at title: AIGatewayIdentityProviderKeyAuthConfig AIGatewayIdentityProviderOpenIDConnectResponse: description: Configuration for an identity provider. type: object properties: display_name: description: The display name for this identity provider instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this identity provider instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - openid-connect x-terraform-transform-const: true config: description: | Configuration for the OpenID Connect identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/openid-connect/reference/ for the list of properties type: object additionalProperties: true properties: auth_methods: description: Types of credentials/grants to enable. type: array items: type: string enum: - authorization_code - bearer - client_credentials - introspection - kong_oauth2 - password - refresh_token - session - userinfo default: - bearer - client_credentials client_id: description: | An array of strings representing the client id for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string client_secret: description: | An array of strings representing the client secret for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string writeOnly: true client_alg: description: Algorithm to use for `client_secret_jwt` or `private_key_jwt` authentication. type: array items: type: string enum: - HS256 - HS384 - HS512 - RS256 - RS384 - RS512 - ES256 - ES384 - ES512 - PS256 - PS384 - PS512 - EdDSA client_auth: description: Client authentication methods used with the identity provider. type: array items: type: string enum: - client_secret_basic - client_secret_post - client_secret_jwt - private_key_jwt - tls_client_auth - self_signed_tls_client_auth - none consumer_claims: description: | An array containing an array of string paths representing the location of the claim in a nested object. For example, to map to user.info.id, set [ "user", "info", "id" ]. type: array items: type: array items: type: string consumer_groups_claim: description: | The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload. type: array items: type: string consumer_groups_optional: description: 'Do not terminate the request if consumer groups mapping fails. ' type: boolean default: false consumer_by: description: Consumer fields used when mapping a token claim to a Kong consumer. type: array items: type: string enum: - id - username - custom_id default: - username - custom_id consumer_optional: description: 'Do not terminate the request if consumer mapping fails. ' type: boolean default: false credential_claim: description: Claim path used to derive virtual credentials when consumer mapping is not used. type: array items: type: string default: - sub issuer: description: URL that identifies the OpenID Provider type: string example: https://dev-123456.okta.com introspection_endpoint: description: Overrides the introspection endpoint returned by discovery. type: string format: uri x-referenceable: true mtls_introspection_endpoint: description: mTLS alias for the introspection endpoint. type: string format: uri cache_introspection: description: Cache introspection endpoint requests. type: boolean default: true jwks_endpoint: description: Overrides the JWKS endpoint returned by discovery. type: string format: uri leeway: description: Leeway, in seconds, for validating token time claims. type: integer default: 0 minimum: 0 scopes: description: 'This field is referenceable. ' type: array items: type: string default: - openid audience_required: description: Audiences required in the access token or introspection response. type: array items: type: string ssl_verify: type: boolean default: true hide_credentials: description: Remove credentials used for authentication before proxying the request upstream. type: boolean default: true keepalive: description: Reuse HTTP client connections for identity provider requests. type: boolean default: true timeout: description: Network I/O timeout, in milliseconds, for identity provider requests. type: integer default: 10000 minimum: 0 http_version: description: HTTP version used for identity provider requests. type: number default: 1.1 enum: - 1 - 1.1 http_proxy: description: HTTP proxy used for identity provider requests. type: string format: uri http_proxy_authorization: description: Authorization header value sent to the HTTP proxy. type: string writeOnly: true https_proxy: description: HTTPS proxy used for identity provider requests. type: string format: uri https_proxy_authorization: description: Authorization header value sent to the HTTPS proxy. type: string writeOnly: true no_proxy: description: Comma-separated hosts that bypass the configured proxies. type: string upstream_headers: description: Map token claims to upstream headers using path-based access. type: array items: type: object required: - header - path properties: header: description: The name of the header. type: string path: description: The path of the header value. type: array items: type: string minItems: 1 cache_tokens_salt: description: 'Salt used for generating the cache key that is used for caching the token endpoint requests. ' type: string principals: description: Map a request to a Kong Identity principal after token verification. type: object properties: enabled: description: When true, look up a Kong Identity principal after token verification. type: boolean default: false directory: description: The Kong Identity directory instance to look up against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" principal_by: description: | Custom identity name for a custom Kong Identity lookup. When absent and principal_claim is set, a lookup is performed using principal_claim as the claim name instead of the default sub claim. type: string minLength: 1 principal_claim: description: | Token claim used for the Kong Identity lookup. If multiple values are set, the claim is inside a nested object of the token payload. Used together with, or instead of, principal_by. type: array items: type: string minLength: 1 minItems: 1 match_consumer: description: | If a consumer is attached to the matched principal, load it and set it in the request context, overriding consumer_by. type: boolean default: true match_consumer_groups: description: 'If consumer groups are attached to the matched principal, load them, overriding consumer_groups_claim. ' type: boolean default: true error_on_miss: description: | When true (default), reject the request if no principal is matched in Kong Identity after token verification. When false, the request continues without an authenticated principal set. type: boolean default: true required: - cache_tokens_salt id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" deprecated: true required: - display_name - name - type - id - created_at - updated_at title: AIGatewayIdentityProviderOpenIDConnectConfig CreateAIGatewayAuthStrategyRequest: discriminator: propertyName: type mapping: key-auth: "#/components/schemas/AIGatewayAuthStrategyKeyAuth" openid-connect: "#/components/schemas/AIGatewayAuthStrategyOpenIDConnect" oneOf: - "$ref": "#/components/schemas/AIGatewayAuthStrategyKeyAuth" - "$ref": "#/components/schemas/AIGatewayAuthStrategyOpenIDConnect" UpdateAIGatewayAuthStrategyRequest: discriminator: propertyName: type mapping: key-auth: "#/components/schemas/AIGatewayAuthStrategyKeyAuth" openid-connect: "#/components/schemas/AIGatewayAuthStrategyOpenIDConnect" oneOf: - "$ref": "#/components/schemas/AIGatewayAuthStrategyKeyAuth" - "$ref": "#/components/schemas/AIGatewayAuthStrategyOpenIDConnect" AIGatewayAuthStrategy: discriminator: propertyName: type mapping: key-auth: "#/components/schemas/AIGatewayAuthStrategyKeyAuthResponse" openid-connect: "#/components/schemas/AIGatewayAuthStrategyOpenIDConnectResponse" oneOf: - "$ref": "#/components/schemas/AIGatewayAuthStrategyKeyAuthResponse" - "$ref": "#/components/schemas/AIGatewayAuthStrategyOpenIDConnectResponse" AIGatewayAuthStrategyKeyAuthResponse: description: Configuration for an auth strategy. type: object properties: display_name: description: The display name for this auth strategy instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - key-auth x-terraform-transform-const: true config: description: | Configuration for the key-auth auth strategy. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/key-auth/reference/ for the list of properties type: object additionalProperties: true properties: hide_credentials: description: | An optional boolean value telling the plugin to show or hide the credential from the upstream service. If true, the plugin strips the credential from the request. type: boolean default: true key_in_body: description: | If enabled, reads the request body. Supported MIME types: application/www-form-urlencoded, application/json, and multipart/form-data. type: boolean default: false key_in_header: description: 'If enabled (default), the plugin reads the request header and tries to find the key in it. ' type: boolean default: true key_in_query: description: 'If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. ' type: boolean default: true key_names: description: 'An array of strings containing the names of the keys to look for in the request. ' type: array items: type: string default: - apikey principals: description: | Authenticate against Kong Identity instead of local credentials. Mutually exclusive with identity realms. type: object properties: enabled: description: When true, authenticate against Kong Identity instead of local credentials. type: boolean default: false directory: description: The Kong Identity directory instance to authenticate against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" error_on_miss: description: | When true (default), reject the request if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. type: boolean default: true id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" required: - display_name - name - type - id - created_at - updated_at title: AIGatewayAuthStrategyKeyAuthConfig AIGatewayAuthStrategyOpenIDConnectResponse: description: Configuration for an auth strategy. type: object properties: display_name: description: The display name for this auth strategy instance. type: string example: Okta AI SE maxLength: 256 minLength: 1 name: description: A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation. example: okta-ai-se allOf: - "$ref": "#/components/schemas/AIGatewayEntityIdentifier" labels: "$ref": "#/components/schemas/PublicLabels" managed_by: "$ref": "#/components/schemas/ManagedBy" type: type: string enum: - openid-connect x-terraform-transform-const: true config: description: | Configuration for the OpenID Connect auth strategy. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/openid-connect/reference/ for the list of properties type: object additionalProperties: true properties: auth_methods: description: Types of credentials/grants to enable. type: array items: type: string enum: - authorization_code - bearer - client_credentials - introspection - kong_oauth2 - password - refresh_token - session - userinfo default: - bearer - client_credentials client_id: description: | An array of strings representing the client id for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string client_secret: description: | An array of strings representing the client secret for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array. type: array items: type: string writeOnly: true client_alg: description: Algorithm to use for `client_secret_jwt` or `private_key_jwt` authentication. type: array items: type: string enum: - HS256 - HS384 - HS512 - RS256 - RS384 - RS512 - ES256 - ES384 - ES512 - PS256 - PS384 - PS512 - EdDSA client_auth: description: Client authentication methods used with the identity provider. type: array items: type: string enum: - client_secret_basic - client_secret_post - client_secret_jwt - private_key_jwt - tls_client_auth - self_signed_tls_client_auth - none consumer_claims: description: | An array containing an array of string paths representing the location of the claim in a nested object. For example, to map to user.info.id, set [ "user", "info", "id" ]. type: array items: type: array items: type: string consumer_groups_claim: description: | The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload. type: array items: type: string consumer_groups_optional: description: 'Do not terminate the request if consumer groups mapping fails. ' type: boolean default: false consumer_by: description: Consumer fields used when mapping a token claim to a Kong consumer. type: array items: type: string enum: - id - username - custom_id default: - username - custom_id consumer_optional: description: 'Do not terminate the request if consumer mapping fails. ' type: boolean default: false credential_claim: description: Claim path used to derive virtual credentials when consumer mapping is not used. type: array items: type: string default: - sub issuer: description: URL that identifies the OpenID Provider type: string example: https://dev-123456.okta.com introspection_endpoint: description: Overrides the introspection endpoint returned by discovery. type: string format: uri x-referenceable: true mtls_introspection_endpoint: description: mTLS alias for the introspection endpoint. type: string format: uri cache_introspection: description: Cache introspection endpoint requests. type: boolean default: true jwks_endpoint: description: Overrides the JWKS endpoint returned by discovery. type: string format: uri leeway: description: Leeway, in seconds, for validating token time claims. type: integer default: 0 minimum: 0 scopes: description: 'This field is referenceable. ' type: array items: type: string default: - openid audience_required: description: Audiences required in the access token or introspection response. type: array items: type: string ssl_verify: type: boolean default: true hide_credentials: description: Remove credentials used for authentication before proxying the request upstream. type: boolean default: true keepalive: description: Reuse HTTP client connections for identity provider requests. type: boolean default: true timeout: description: Network I/O timeout, in milliseconds, for identity provider requests. type: integer default: 10000 minimum: 0 http_version: description: HTTP version used for identity provider requests. type: number default: 1.1 enum: - 1 - 1.1 http_proxy: description: HTTP proxy used for identity provider requests. type: string format: uri http_proxy_authorization: description: Authorization header value sent to the HTTP proxy. type: string writeOnly: true https_proxy: description: HTTPS proxy used for identity provider requests. type: string format: uri https_proxy_authorization: description: Authorization header value sent to the HTTPS proxy. type: string writeOnly: true no_proxy: description: Comma-separated hosts that bypass the configured proxies. type: string upstream_headers: description: Map token claims to upstream headers using path-based access. type: array items: type: object required: - header - path properties: header: description: The name of the header. type: string path: description: The path of the header value. type: array items: type: string minItems: 1 cache_tokens_salt: description: 'Salt used for generating the cache key that is used for caching the token endpoint requests. ' type: string principals: description: Map a request to a Kong Identity principal after token verification. type: object properties: enabled: description: When true, look up a Kong Identity principal after token verification. type: boolean default: false directory: description: The Kong Identity directory instance to look up against. type: string default: default pattern: "^[a-zA-Z0-9_-]+$" principal_by: description: | Custom identity name for a custom Kong Identity lookup. When absent and principal_claim is set, a lookup is performed using principal_claim as the claim name instead of the default sub claim. type: string minLength: 1 principal_claim: description: | Token claim used for the Kong Identity lookup. If multiple values are set, the claim is inside a nested object of the token payload. Used together with, or instead of, principal_by. type: array items: type: string minLength: 1 minItems: 1 match_consumer: description: | If a consumer is attached to the matched principal, load it and set it in the request context, overriding consumer_by. type: boolean default: true match_consumer_groups: description: 'If consumer groups are attached to the matched principal, load them, overriding consumer_groups_claim. ' type: boolean default: true error_on_miss: description: | When true (default), reject the request if no principal is matched in Kong Identity after token verification. When false, the request continues without an authenticated principal set. type: boolean default: true required: - cache_tokens_salt id: "$ref": "#/components/schemas/UUID" created_at: "$ref": "#/components/schemas/CreatedAt" updated_at: "$ref": "#/components/schemas/UpdatedAt" required: - display_name - name - type - id - created_at - updated_at title: AIGatewayAuthStrategyOpenIDConnectConfig PublicLabels: description: "Public labels store information about an entity that can be used for filtering a list of objects.\n\nPublic labels are intended to store **PUBLIC** metadata. \n\nKeys must be of length 1-63 characters, and cannot start with \"kong\", \"konnect\", \"mesh\", \"kic\", or \"_\".\n" type: object example: category: finance additionalProperties: type: string pattern: "^[a-z0-9A-Z]{1}([a-z0-9A-Z-._]*[a-z0-9A-Z]+)?$" minLength: 1 maxLength: 63 maxProperties: 50 title: PublicLabels UUID: description: Contains a unique identifier used for this resource. type: string format: uuid example: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7 readOnly: true CreatedAt: description: An ISO-8601 timestamp representation of entity creation date. type: string format: date-time example: '2022-11-04T20:10:06.927Z' readOnly: true UpdatedAt: description: An ISO-8601 timestamp representation of entity update date. type: string format: date-time example: '2022-11-04T20:10:06.927Z' readOnly: true PageMeta: description: Contains pagination query parameters and the total number of objects returned. type: object properties: number: type: number example: 1 size: type: number example: 10 total: type: number example: 100 required: - number - size - total PaginatedMeta: description: returns the pagination information type: object properties: page: "$ref": "#/components/schemas/PageMeta" required: - page title: PaginatedMeta BaseError: description: standard error type: object properties: status: description: | The HTTP status code of the error. Useful when passing the response body to child properties in a frontend UI. Must be returned as an integer. type: integer readOnly: true title: description: | A short, human-readable summary of the problem. It should not change between occurences of a problem, except for localization. Should be provided as "Sentence case" for direct use in the UI. type: string readOnly: true type: description: The error type. type: string readOnly: true instance: description: | Used to return the correlation ID back to the user, in the format kong:trace:. This helps us find the relevant logs when a customer reports an issue. type: string readOnly: true detail: description: | A human readable explanation specific to this occurence of the problem. This field may contain request/entity data to help the user understand what went wrong. Enclose variable values in square brackets. Should be provided as "Sentence case" for direct use in the UI. type: string readOnly: true required: - status - title - instance - detail title: Error UnauthorizedError: allOf: - "$ref": "#/components/schemas/BaseError" - type: object properties: status: example: 401 title: example: Unauthorized type: example: https://httpstatuses.com/401 instance: example: kong:trace:1234567890 detail: example: Invalid credentials ForbiddenError: allOf: - "$ref": "#/components/schemas/BaseError" - type: object properties: status: example: 403 title: example: Forbidden type: example: https://httpstatuses.com/403 instance: example: kong:trace:1234567890 detail: example: Forbidden TooManyRequestsError: allOf: - "$ref": "#/components/schemas/BaseError" - type: object properties: status: example: 429 title: example: Too Many Requests type: example: https://httpstatuses.com/429 instance: example: kong:trace:1234567890 detail: example: Too Many Requests InvalidRules: description: invalid parameters rules type: string enum: - required - is_array - is_base64 - is_boolean - is_date_time - is_integer - is_null - is_number - is_object - is_string - is_uuid - is_fqdn - is_arn - unknown_property - missing_reference - is_label - matches_regex - invalid - is_supported_network_availability_zone_list - is_supported_network_cidr_block - is_supported_provider_region - type nullable: true readOnly: true InvalidParameterStandard: type: object properties: field: type: string example: name readOnly: true rule: "$ref": "#/components/schemas/InvalidRules" source: type: string example: body reason: type: string example: is a required field readOnly: true additionalProperties: false required: - field - reason InvalidParameterMinimumLength: type: object properties: field: type: string example: name readOnly: true rule: description: invalid parameters rules type: string enum: - min_length - min_digits - min_lowercase - min_uppercase - min_symbols - min_items - min nullable: false readOnly: true minimum: type: integer example: 8 source: type: string example: body reason: type: string example: must have at least 8 characters readOnly: true additionalProperties: false required: - field - reason - rule - minimum InvalidParameterMaximumLength: type: object properties: field: type: string example: name readOnly: true rule: description: invalid parameters rules type: string enum: - max_length - max_items - max nullable: false readOnly: true maximum: type: integer example: 8 source: type: string example: body reason: type: string example: must not have more than 8 characters readOnly: true additionalProperties: false required: - field - reason - rule - maximum InvalidParameterChoiceItem: type: object properties: field: type: string example: name readOnly: true rule: description: invalid parameters rules type: string enum: - enum nullable: false readOnly: true reason: type: string example: is a required field readOnly: true choices: type: array items: {} minItems: 1 nullable: false readOnly: true uniqueItems: true source: type: string example: body additionalProperties: false required: - field - reason - rule - choices InvalidParameterDependentItem: type: object properties: field: type: string example: name readOnly: true rule: description: invalid parameters rules type: string enum: - dependent_fields nullable: true readOnly: true reason: type: string example: is a required field readOnly: true dependents: type: array items: {} nullable: true readOnly: true uniqueItems: true source: type: string example: body additionalProperties: false required: - field - rule - reason - dependents InvalidParameters: description: invalid parameters type: array items: oneOf: - "$ref": "#/components/schemas/InvalidParameterStandard" - "$ref": "#/components/schemas/InvalidParameterMinimumLength" - "$ref": "#/components/schemas/InvalidParameterMaximumLength" - "$ref": "#/components/schemas/InvalidParameterChoiceItem" - "$ref": "#/components/schemas/InvalidParameterDependentItem" minItems: 1 nullable: false uniqueItems: true BadRequestError: allOf: - "$ref": "#/components/schemas/BaseError" - type: object required: - invalid_parameters properties: invalid_parameters: "$ref": "#/components/schemas/InvalidParameters" ConflictError: allOf: - "$ref": "#/components/schemas/BaseError" - type: object properties: status: example: 409 title: example: Conflict type: example: https://httpstatuses.com/409 instance: example: kong:trace:1234567890 detail: example: Conflict NotFoundError: allOf: - "$ref": "#/components/schemas/BaseError" - type: object properties: status: example: 404 title: example: Not Found type: example: https://httpstatuses.com/404 instance: example: kong:trace:1234567890 detail: example: Not found CursorMetaPage: type: object properties: first: description: URI to the first page type: string format: path last: description: URI to the last page type: string format: path next: description: URI to the next page type: string format: path nullable: true previous: description: URI to the previous page type: string format: path nullable: true size: description: Requested page size type: number example: 10 required: - size - next - previous CursorMeta: description: Pagination metadata. type: object properties: page: "$ref": "#/components/schemas/CursorMetaPage" required: - page ManagedBy: description: | Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. type: object example: owner: terraform additionalProperties: type: string pattern: "^[a-z0-9A-Z]{1}([a-z0-9A-Z-._]*[a-z0-9A-Z]+)?$" minLength: 1 maxLength: 63 maxProperties: 5 title: ManagedBy CursorMetaWithTotal: description: Pagination metadata with exact total. Useful when the collection size is inexpensive to provide. type: object properties: page: allOf: - "$ref": "#/components/schemas/CursorMetaPage" - type: object required: - total properties: total: description: Total number of objects in the collection type: number example: 974 required: - page examples: AIGatewayExample: value: id: bf138ba2-c9b1-4229-b268-04d9d8a6410b display_name: My AI Gateway name: my-ai-gateway description: An AI Gateway for my organization. deployment_type: hybrid labels: env: production endpoints: configuration: https://acfe5f253f.cp.konghq.com telemetry: https://acfe5f253f.tp0.konghq.com config_hash: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 created_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-01T00:00:00.000Z' AIGatewayDataplaneCertificateExample: value: title: My AI Gateway Data Plane Certificate description: My description cert: "-----BEGIN CERTIFICATE-----\r\n*****\r\n-----END CERTIFICATE-----\r\n" CreateAIGatewayRequestExample: value: display_name: My AI Gateway name: my-ai-gateway description: An AI Gateway for my organization. labels: env: production UpdateAIGatewayRequestExample: value: display_name: My Updated AI Gateway name: my-ai-gateway description: An updated description. labels: env: staging PatchAIGatewayRequestExample: value: display_name: My Updated AI Gateway description: An updated description. labels: env: staging ListAIGatewaysResponseExample: value: meta: page: number: 1 size: 10 total: 1 data: - id: bf138ba2-c9b1-4229-b268-04d9d8a6410b display_name: My AI Gateway name: my-ai-gateway description: An AI Gateway for my organization. deployment_type: hybrid labels: env: production endpoints: configuration: https://acfe5f253f.cp.konghq.com telemetry: https://acfe5f253f.tp0.konghq.com proxy_urls: - host: example.com port: 443 protocol: https config_hash: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 created_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-01T00:00:00.000Z' UnauthorizedExample: value: status: 401 title: Unauthorized instance: kong:trace:8347343766220159418 detail: Unauthorized ForbiddenExample: value: status: 403 title: Forbidden instance: kong:trace:2723154947768991354 detail: You do not have permission to perform this action NotFoundExample: value: status: 404 title: Not Found instance: kong:trace:6816496025408232265 detail: Not Found responses: ListAIGatewaysResponse: description: A paginated list of AI Gateways. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGateway" meta: "$ref": "#/components/schemas/PaginatedMeta" additionalProperties: false required: - data - meta title: ListAIGatewaysResponse examples: List AI Gateways Response: "$ref": "#/components/examples/ListAIGatewaysResponseExample" CreateAIGatewayResponse: description: AI Gateway created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGateway" examples: AI Gateway Response: "$ref": "#/components/examples/AIGatewayExample" GetAIGatewayResponse: description: A successful response returning an AI Gateway. content: application/json: schema: "$ref": "#/components/schemas/AIGateway" examples: AI Gateway Response: "$ref": "#/components/examples/AIGatewayExample" UpdateAIGatewayResponse: description: AI Gateway updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGateway" examples: AI Gateway Response: "$ref": "#/components/examples/AIGatewayExample" PatchAIGatewayResponse: description: AI Gateway updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGateway" examples: AI Gateway Response: "$ref": "#/components/examples/AIGatewayExample" CreateAIGatewayModelResponse: description: Model created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayModel" GetAIGatewayModelResponse: description: A successful response returning the AI Gateway Model. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayModel" UpdateAIGatewayModelResponse: description: Model updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayModel" ListAIGatewayModelsResponse: description: A successful response listing AI Gateway Models. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayModel" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta ListAIGatewayCACertificatesResponse: description: A paginated list of AI Gateway CA Certificates. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayCACertificate" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayCACertificateResponse: description: AI Gateway CA Certificate created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayCACertificate" GetAIGatewayCACertificateResponse: description: A successful response returning an AI Gateway CA Certificate. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayCACertificate" UpdateAIGatewayCACertificateResponse: description: CA Certificate updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayCACertificate" ListAIGatewayCertificatesResponse: description: A paginated list of AI Gateway Certificates. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayCertificate" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayCertificateResponse: description: AI Gateway Certificate created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayCertificate" GetAIGatewayCertificateResponse: description: A successful response returning an AI Gateway Certificate. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayCertificate" UpdateAIGatewayCertificateResponse: description: Certificate updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayCertificate" ListAIGatewaySNIsResponse: description: A paginated list of AI Gateway SNIs. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewaySNI" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewaySNIResponse: description: AI Gateway SNI created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewaySNI" GetAIGatewaySNIResponse: description: A successful response returning an AI Gateway SNI. content: application/json: schema: "$ref": "#/components/schemas/AIGatewaySNI" UpdateAIGatewaySNIResponse: description: SNI updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewaySNI" ListAIGatewayDataPlaneCertificatesResponse: description: Example response content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayDataPlaneClientCertificate" meta: "$ref": "#/components/schemas/CursorMeta" additionalProperties: false required: - data - meta CreateAIGatewayDataPlaneCertificateResponse: description: Response body for creating a DataPlane certificate. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayDataPlaneClientCertificate" GetAIGatewayDataPlaneCertificateResponse: description: Response body for retrieving a DataPlane certificate. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayDataPlaneClientCertificate" ListAIGatewayDataPlaneNodesResponse: description: A successful response listing AI Gateway Data Plane Nodes. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayDataPlaneNode" meta: "$ref": "#/components/schemas/CursorMetaWithTotal" required: - data - meta GetAIGatewayExpectedConfigVersionResponse: description: Response body for retrieving the expected config version of the AI Gateway. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayExpectedConfigVersion" GetAIGatewayDataPlaneNodeResponse: description: A successful response containing the AI Gateway Data Plane Node. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayDataPlaneNode" ListAIGatewayVaultsResponse: description: A paginated list of AI Gateway Vaults. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayVault" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayVaultResponse: description: AI Gateway Vault created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayVault" GetAIGatewayVaultResponse: description: A successful response returning an AI Gateway Vault. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayVault" UpdateAIGatewayVaultResponse: description: Vault updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayVault" CreateAIGatewayPolicyResponse: description: Policy created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayPolicy" GetAIGatewayPolicyResponse: description: A successful response returning the AI Gateway Policy. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayPolicy" UpdateAIGatewayPolicyResponse: description: Policy updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayPolicy" ListAIGatewayPoliciesResponse: description: A successful response listing AI Gateway Policies. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayPolicy" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta ListAIGatewayMCPServersResponse: description: A paginated list of MCP Servers. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayMCPServer" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayMCPServerResponse: description: MCP Server created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayMCPServer" GetMCPServerResponse: description: A successful response returning an MCP Server. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayMCPServer" UpdateAIGatewayMCPServerResponse: description: MCP Server updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayMCPServer" ListAIGatewayModelProvidersResponse: description: A paginated list of AI Gateway Model Providers. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayModelProvider" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta ListAIGatewayAgentsResponse: description: A paginated list of AI Agents. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayAgent" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayAgentResponse: description: AI Agent created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayAgent" GetAIGatewayAgentResponse: description: A successful response returning an AI Gateway Agent. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayAgent" UpdateAIGatewayAgentResponse: description: Agent updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayAgent" ListAIGatewayConsumersResponse: description: A paginated list of AI Gateway Consumers. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayConsumer" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayConsumerResponse: description: AI Gateway Consumer created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumer" GetAIGatewayConsumerResponse: description: A successful response returning an AI Gateway Consumer. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumer" UpdateAIGatewayConsumerResponse: description: Consumer updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumer" ListAIGatewayConsumerCredentialsResponse: description: A paginated list of AI Gateway Consumer credentials. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayConsumerCredential" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayConsumerCredentialResponse: description: AI Gateway Consumer credential created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumerCredentialWithKey" GetAIGatewayConsumerCredentialResponse: description: A successful response returning an AI Gateway Consumer credential. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumerCredential" ListAIGatewayConsumerGroupsResponse: description: A paginated list of AI Gateway Consumer Groups. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayConsumerGroup" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayConsumerGroupResponse: description: AI Gateway Consumer Group created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumerGroup" GetAIGatewayConsumerGroupResponse: description: A successful response returning an AI Gateway Consumer Group. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumerGroup" UpdateAIGatewayConsumerGroupResponse: description: Consumer Group updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConsumerGroup" AddAIGatewayConsumerToGroupResponse: description: Consumer added to consumer group successfully. content: application/json: schema: type: object properties: consumer: "$ref": "#/components/schemas/AIGatewayConsumer" consumer_group: "$ref": "#/components/schemas/AIGatewayConsumerGroup" required: - consumer - consumer_group ListAIGatewayConfigStoresResponse: description: A paginated list of AI Gateway Config Stores. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayConfigStore" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayConfigStoreResponse: description: AI Gateway Config Store created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConfigStore" GetAIGatewayConfigStoreResponse: description: A successful response returning an AI Gateway Config Store. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConfigStore" UpdateAIGatewayConfigStoreResponse: description: Config Store updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConfigStore" ListAIGatewayConfigStoreSecretsResponse: description: A paginated list of AI Gateway Config Store Secrets. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayConfigStoreSecret" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayConfigStoreSecretResponse: description: AI Gateway Config Store Secret created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConfigStoreSecret" GetAIGatewayConfigStoreSecretResponse: description: A successful response returning an AI Gateway Config Store Secret. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConfigStoreSecret" UpdateAIGatewayConfigStoreSecretResponse: description: Config Store Secret updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayConfigStoreSecret" CreateAIGatewayModelProviderResponse: description: Model provider created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayModelProvider" GetAIGatewayModelProviderResponse: description: A successful response returning an AI Gateway Model Provider. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayModelProvider" UpdateAIGatewayModelProviderResponse: description: Model provider updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayModelProvider" CreateAIGatewayIdentityProviderResponse: description: Identity Provider created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayIdentityProvider" GetAIGatewayIdentityProviderResponse: description: A successful response returning an AI Gateway Identity Provider. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayIdentityProvider" UpdateAIGatewayIdentityProviderResponse: description: Identity provider updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayIdentityProvider" ListAIGatewayIdentityProvidersResponse: description: A paginated list of AI Gateway Identity Providers. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayIdentityProvider" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta CreateAIGatewayAuthStrategyResponse: description: Auth strategy created successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayAuthStrategy" GetAIGatewayAuthStrategyResponse: description: A successful response returning an AI Gateway Auth Strategy. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayAuthStrategy" UpdateAIGatewayAuthStrategyResponse: description: Auth strategy updated successfully. content: application/json: schema: "$ref": "#/components/schemas/AIGatewayAuthStrategy" ListAIGatewayAuthStrategiesResponse: description: A paginated list of AI Gateway Auth Strategies. content: application/json: schema: type: object properties: data: type: array items: "$ref": "#/components/schemas/AIGatewayAuthStrategy" meta: "$ref": "#/components/schemas/CursorMeta" required: - data - meta Unauthorized: description: Unauthorized content: application/problem+json: schema: "$ref": "#/components/schemas/UnauthorizedError" examples: UnauthorizedExample: "$ref": "#/components/examples/UnauthorizedExample" Forbidden: description: Forbidden content: application/problem+json: schema: "$ref": "#/components/schemas/ForbiddenError" examples: UnauthorizedExample: "$ref": "#/components/examples/ForbiddenExample" TooManyRequests: description: Too Many Requests content: application/problem+json: schema: "$ref": "#/components/schemas/TooManyRequestsError" BadRequest: description: Bad Request content: application/problem+json: schema: "$ref": "#/components/schemas/BadRequestError" Conflict: description: Conflict content: application/problem+json: schema: "$ref": "#/components/schemas/ConflictError" NotFound: description: Not Found content: application/problem+json: schema: "$ref": "#/components/schemas/NotFoundError" examples: NotFoundExample: "$ref": "#/components/examples/NotFoundExample" securitySchemes: konnectAccessToken: type: http scheme: bearer bearerFormat: JWT description: 'The Konnect access token is meant to be used by the Konnect dashboard and the decK CLI authenticate with. ' tags: - name: AI Gateways description: API related to the management of Konnect AI Gateway resources. - name: AI Gateway DataPlane Certificates description: API related to the management of AI Gateway DataPlane Certificates. - name: AI Gateway CA Certificates description: API related to the management of AI Gateway CA Certificates. - name: AI Gateway Certificates description: API related to the management of AI Gateway Certificates. - name: AI Gateway Nodes description: API related to the management of AI Gateway nodes. - name: AI Gateway Config Stores description: API related to the management of AI Gateway Config Stores. - name: AI Gateway Vaults description: API related to the management of AI Gateway vaults for storing secrets. - name: AI Gateway Agents description: AI Agents registered with the AI Gateway. - name: AI Gateway Consumers description: Individual consumers with credentials and group memberships for AI Gateway access control. - name: AI Gateway Consumer Groups description: Consumer groups for applying rate-limiting and access policies to AI Gateway traffic. - name: AI Gateway Identity Providers description: Deprecated in favor of AI Gateway Auth Strategies. Identity providers for authenticating users and accessing AI Gateway resources. - name: AI Gateway Auth Strategies description: Auth strategies for authenticating clients accessing AI Gateway resources. - name: AI Gateway Models description: Models that define routing, capabilities, and backend targets for the AI Gateway. - name: AI Gateway Policies description: Policies that control security, rate-limiting, and guardrail behavior for the AI Gateway. - name: AI Gateway MCP Servers description: MCP Servers that expose tools for AI Gateway integrations. - name: AI Gateway Model Providers description: Model providers that define the backend AI service connections for the AI Gateway. security: - konnectAccessToken: [] ```