published on Friday, Nov 6, 2026 by kong
published on Friday, Nov 6, 2026 by kong
AIGatewayMCPServer Resource
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as konnect from "@pulumi/konnect";
const myAigatewaymcpserver = new konnect.AiGatewayMcpServer("my_aigatewaymcpserver", {
conversionListener: {
access: {
oauthAccessToken: {
accessTokenClaimField: "...my_access_token_claim_field...",
acls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
authStrategies: ["okta-ai-se"],
defaultToolAcls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
identityProviders: ["okta-ai-se"],
metadata: {
authorizationServers: ["..."],
discoveryEndpoint: "...my_discovery_endpoint...",
endpoint: "...my_endpoint...",
resource: "...my_resource...",
scopesSupporteds: ["..."],
},
},
},
config: {
allowedVersions: ["2025-06-18"],
caCertificates: ["my-ca-certificate"],
cache: {
discover: {
cacheScope: "private",
ttlMs: 5,
},
toolsList: {
cacheScope: "private",
ttlMs: 1,
},
},
certificates: ["my-certificate"],
logging: {
audits: false,
payloads: false,
},
maxRequestBodySize: 8388608,
route: {
headers: {
key: JSON.stringify("value"),
},
hosts: ["foo.example.com"],
httpsRedirectStatusCode: 426,
methods: ["..."],
paths: ["..."],
preserveHost: false,
protocols: ["..."],
regexPriority: 0,
requestBuffering: true,
responseBuffering: true,
stripPath: true,
tags: ["..."],
},
server: {
forwardClientHeaders: true,
session: {
client: {
secrets: ["..."],
},
managed: true,
redis: {
cloudAuthentication: {
azure: {
clientId: "...my_client_id...",
clientSecret: "...my_client_secret...",
tenantId: "...my_tenant_id...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 1275755412,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "slave",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
sessionTtl: 86400,
strategy: "redis",
},
timeout: 10000,
},
upstream: {
auth: {
aws: {
accessKeyId: "...my_access_key_id...",
assumeRoleArn: "...my_assume_role_arn...",
region: "...my_region...",
roleSessionName: "...my_role_session_name...",
secretAccessKey: "...my_secret_access_key...",
sessionToken: "...my_session_token...",
stsEndpointUrl: "...my_sts_endpoint_url...",
},
},
},
url: "https://mcp.internal.kongair.com",
},
datastores: [{
name: "shared-redis",
}],
displayName: "Kong Air Flights",
enabled: true,
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "kongair-flights",
policies: ["..."],
rateLimiting: {
limits: [{
limit: 100,
method: "tools/call",
tool: "search_flights",
windowSize: 60,
}],
},
tokenVault: {
cache: {
redis: {
cloudAuthentication: {
aws: {
accessKeyId: "...my_access_key_id...",
assumeRoleArn: "...my_assume_role_arn...",
cacheName: "...my_cache_name...",
isServerless: true,
region: "...my_region...",
roleSessionName: "...my_role_session_name...",
secretAccessKey: "...my_secret_access_key...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 2020486820,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "master",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
},
credential: {
inbound: {
location: "header",
name: "...my_name...",
prefix: "...my_prefix...",
},
outbound: {
location: "query",
name: "...my_name...",
prefix: "...my_prefix...",
},
},
provider: "...my_provider...",
subjectTokenType: "access_token",
},
tools: [{
access: {
acls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
},
annotations: {
destructiveHint: true,
idempotentHint: false,
openWorldHint: false,
readOnlyHint: true,
title: "...my_title...",
},
description: "Search for available flights",
headers: "{ \"see\": \"documentation\" }",
host: "...my_host...",
method: "POST",
name: "...my_name...",
parameters: [{
description: "The origin airport code.",
"in": "query",
name: "origin",
required: true,
schema: {
key: JSON.stringify("value"),
},
}],
path: "...my_path...",
query: "{ \"see\": \"documentation\" }",
requestBody: "{ \"see\": \"documentation\" }",
responses: "{ \"see\": \"documentation\" }",
scheme: "https",
}],
},
conversionOnly: {
config: {
caCertificates: ["my-ca-certificate"],
certificates: ["my-certificate"],
logging: {
audits: false,
payloads: false,
},
maxRequestBodySize: 8388608,
route: {
headers: {
key: JSON.stringify("value"),
},
hosts: ["foo.example.com"],
httpsRedirectStatusCode: 426,
methods: ["..."],
paths: ["..."],
preserveHost: false,
protocols: ["..."],
regexPriority: 0,
requestBuffering: true,
responseBuffering: true,
stripPath: true,
tags: ["..."],
},
upstream: {
auth: {
aws: {
accessKeyId: "...my_access_key_id...",
assumeRoleArn: "...my_assume_role_arn...",
region: "...my_region...",
roleSessionName: "...my_role_session_name...",
secretAccessKey: "...my_secret_access_key...",
sessionToken: "...my_session_token...",
stsEndpointUrl: "...my_sts_endpoint_url...",
},
},
},
url: "https://mcp.internal.kongair.com",
},
datastores: [{
name: "shared-redis",
}],
displayName: "Kong Air Flights",
enabled: true,
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "kongair-flights",
policies: ["..."],
tokenVault: {
cache: {
redis: {
cloudAuthentication: {
gcp: {
serviceAccountJson: "...my_service_account_json...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 1023472511,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "slave",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
},
credential: {
inbound: {
location: "query",
name: "...my_name...",
prefix: "...my_prefix...",
},
outbound: {
location: "body",
name: "...my_name...",
prefix: "...my_prefix...",
},
},
provider: "...my_provider...",
subjectTokenType: "access_token",
},
tools: [{
access: {
acls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
},
annotations: {
destructiveHint: false,
idempotentHint: true,
openWorldHint: true,
readOnlyHint: false,
title: "...my_title...",
},
description: "Search for available flights",
headers: "{ \"see\": \"documentation\" }",
host: "...my_host...",
method: "PATCH",
name: "...my_name...",
parameters: [{
description: "The origin airport code.",
"in": "query",
name: "origin",
required: true,
schema: {
key: JSON.stringify("value"),
},
}],
path: "...my_path...",
query: "{ \"see\": \"documentation\" }",
requestBody: "{ \"see\": \"documentation\" }",
responses: "{ \"see\": \"documentation\" }",
scheme: "http",
}],
},
gatewayId: "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
listener: {
access: {
oauthAccessToken: {
accessTokenClaimField: "...my_access_token_claim_field...",
acls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
authStrategies: ["okta-ai-se"],
defaultToolAcls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
identityProviders: ["okta-ai-se"],
metadata: {
authorizationServers: ["..."],
discoveryEndpoint: "...my_discovery_endpoint...",
endpoint: "...my_endpoint...",
resource: "...my_resource...",
scopesSupporteds: ["..."],
},
},
},
config: {
allowedVersions: ["2025-11-25"],
cache: {
discover: {
cacheScope: "private",
ttlMs: 8,
},
toolsList: {
cacheScope: "private",
ttlMs: 6,
},
},
logging: {
audits: false,
payloads: false,
},
maxRequestBodySize: 8388608,
route: {
headers: {
key: JSON.stringify("value"),
},
hosts: ["foo.example.com"],
httpsRedirectStatusCode: 426,
methods: ["..."],
paths: ["..."],
preserveHost: false,
protocols: ["..."],
regexPriority: 0,
requestBuffering: true,
responseBuffering: true,
stripPath: true,
tags: ["..."],
},
server: {
forwardClientHeaders: true,
session: {
client: {
secrets: ["..."],
},
managed: true,
redis: {
cloudAuthentication: {
gcp: {
serviceAccountJson: "...my_service_account_json...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 254844406,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "master",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
sessionTtl: 86400,
strategy: "redis",
},
timeout: 10000,
},
},
datastores: [{
name: "shared-redis",
}],
displayName: "Kong Air Flights",
enabled: true,
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "kongair-flights",
policies: ["..."],
sources: [
"kongair-flights",
"github-mcp",
],
tokenVault: {
cache: {
redis: {
cloudAuthentication: {
aws: {
accessKeyId: "...my_access_key_id...",
assumeRoleArn: "...my_assume_role_arn...",
cacheName: "...my_cache_name...",
isServerless: true,
region: "...my_region...",
roleSessionName: "...my_role_session_name...",
secretAccessKey: "...my_secret_access_key...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 1304566812,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "master",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
},
credential: {
inbound: {
location: "header",
name: "...my_name...",
prefix: "...my_prefix...",
},
outbound: {
location: "query",
name: "...my_name...",
prefix: "...my_prefix...",
},
},
provider: "...my_provider...",
subjectTokenType: "api_key",
},
},
passthroughListener: {
access: {
consumer: {
acls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
authStrategies: ["okta-ai-se"],
defaultToolAcls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
identityProviders: ["okta-ai-se"],
metadata: {
authorizationServers: ["..."],
discoveryEndpoint: "...my_discovery_endpoint...",
endpoint: "...my_endpoint...",
resource: "...my_resource...",
scopesSupporteds: ["..."],
},
},
},
config: {
caCertificates: ["my-ca-certificate"],
certificates: ["my-certificate"],
logging: {
audits: false,
payloads: false,
},
maxRequestBodySize: 8388608,
proxy: {
auth: {
password: "...my_password...",
username: "...my_username...",
},
httpProxy: {
host: "...my_host...",
port: 43233,
},
httpsProxy: {
host: "...my_host...",
port: 31216,
},
noProxy: "...my_no_proxy...",
proxyScheme: "http",
},
route: {
headers: {
key: JSON.stringify("value"),
},
hosts: ["foo.example.com"],
httpsRedirectStatusCode: 426,
methods: ["..."],
paths: ["..."],
preserveHost: false,
protocols: ["..."],
regexPriority: 0,
requestBuffering: true,
responseBuffering: true,
stripPath: true,
tags: ["..."],
},
server: {
forwardClientHeaders: true,
session: {
client: {
secrets: ["..."],
},
managed: true,
redis: {
cloudAuthentication: {
azure: {
clientId: "...my_client_id...",
clientSecret: "...my_client_secret...",
tenantId: "...my_tenant_id...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 1750673053,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "any",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
sessionTtl: 86400,
strategy: "redis",
},
timeout: 10000,
},
upstream: {
auth: {
aws: {
accessKeyId: "...my_access_key_id...",
assumeRoleArn: "...my_assume_role_arn...",
region: "...my_region...",
roleSessionName: "...my_role_session_name...",
secretAccessKey: "...my_secret_access_key...",
sessionToken: "...my_session_token...",
stsEndpointUrl: "...my_sts_endpoint_url...",
},
},
},
url: "https://mcp.internal.kongair.com",
},
datastores: [{
name: "shared-redis",
}],
displayName: "Kong Air Flights",
enabled: true,
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "kongair-flights",
policies: ["..."],
rateLimiting: {
limits: [{
limit: 100,
method: "tools/call",
tool: "search_flights",
windowSize: 60,
}],
},
tokenVault: {
cache: {
redis: {
cloudAuthentication: {
gcp: {
serviceAccountJson: "...my_service_account_json...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 1262712627,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "any",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
},
credential: {
inbound: {
location: "query",
name: "...my_name...",
prefix: "...my_prefix...",
},
outbound: {
location: "header",
name: "...my_name...",
prefix: "...my_prefix...",
},
},
provider: "...my_provider...",
subjectTokenType: "api_key",
},
tools: [{
access: {
acls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
},
name: "...my_name...",
}],
},
upstreamServer: {
config: {
caCertificates: ["my-ca-certificate"],
certificates: ["my-certificate"],
logging: {
audits: false,
payloads: false,
},
maxRequestBodySize: 8388608,
route: {
headers: {
key: JSON.stringify("value"),
},
hosts: ["foo.example.com"],
httpsRedirectStatusCode: 426,
methods: ["..."],
paths: ["..."],
preserveHost: false,
protocols: ["..."],
regexPriority: 0,
requestBuffering: true,
responseBuffering: true,
stripPath: true,
tags: ["..."],
},
server: {
forwardClientHeaders: true,
preserveUpstreamToolNames: false,
session: {
client: {
secrets: ["..."],
},
managed: true,
redis: {
cloudAuthentication: {
gcp: {
serviceAccountJson: "...my_service_account_json...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 176733398,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "master",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
sessionTtl: 86400,
strategy: "redis",
},
timeout: 10000,
toolsListAuth: {
jwt: {
accessTokenHeader: "Authorization",
idTokenHeader: "...my_id_token_header...",
scope: "...my_scope...",
},
},
upstreamProtocolVersion: "2025-06-18",
},
toolsCacheTtlSeconds: 7,
upstream: {
auth: {
aws: {
accessKeyId: "...my_access_key_id...",
assumeRoleArn: "...my_assume_role_arn...",
region: "...my_region...",
roleSessionName: "...my_role_session_name...",
secretAccessKey: "...my_secret_access_key...",
sessionToken: "...my_session_token...",
stsEndpointUrl: "...my_sts_endpoint_url...",
},
},
},
url: "https://mcp.internal.kongair.com",
},
datastores: [{
name: "shared-redis",
}],
displayName: "Kong Air Flights",
enabled: true,
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "kongair-flights",
policies: ["..."],
tokenVault: {
cache: {
redis: {
cloudAuthentication: {
gcp: {
serviceAccountJson: "...my_service_account_json...",
},
},
cluster: {
maxRedirections: 5,
nodes: [{
ip: "127.0.0.1",
port: 6379,
}],
},
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepalive: {
backlog: 1008848731,
poolSize: 256,
},
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinel: {
master: "...my_master...",
nodes: [{
host: "127.0.0.1",
port: 6379,
}],
password: "...my_password...",
role: "any",
username: "...my_username...",
},
serverName: "...my_server_name...",
ssl: true,
sslVerify: true,
username: "...my_username...",
},
},
credential: {
inbound: {
location: "body",
name: "...my_name...",
prefix: "...my_prefix...",
},
outbound: {
location: "header",
name: "...my_name...",
prefix: "...my_prefix...",
},
},
provider: "...my_provider...",
subjectTokenType: "api_key",
},
tools: [{
access: {
acls: {
allows: ["..."],
allowWhens: ["..."],
denies: ["..."],
denyWhens: ["..."],
},
},
annotations: {
destructiveHint: true,
idempotentHint: true,
openWorldHint: false,
readOnlyHint: true,
title: "...my_title...",
},
description: "Search for available flights",
inputSchema: "{ \"see\": \"documentation\" }",
name: "...my_name...",
outputSchema: "{ \"see\": \"documentation\" }",
}],
},
});
import pulumi
import json
import pulumi_konnect as konnect
my_aigatewaymcpserver = konnect.AiGatewayMcpServer("my_aigatewaymcpserver",
conversion_listener={
"access": {
"oauth_access_token": {
"access_token_claim_field": "...my_access_token_claim_field...",
"acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
"auth_strategies": ["okta-ai-se"],
"default_tool_acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
"identity_providers": ["okta-ai-se"],
"metadata": {
"authorization_servers": ["..."],
"discovery_endpoint": "...my_discovery_endpoint...",
"endpoint": "...my_endpoint...",
"resource": "...my_resource...",
"scopes_supporteds": ["..."],
},
},
},
"config": {
"allowed_versions": ["2025-06-18"],
"ca_certificates": ["my-ca-certificate"],
"cache": {
"discover": {
"cache_scope": "private",
"ttl_ms": 5,
},
"tools_list": {
"cache_scope": "private",
"ttl_ms": 1,
},
},
"certificates": ["my-certificate"],
"logging": {
"audits": False,
"payloads": False,
},
"max_request_body_size": 8388608,
"route": {
"headers": {
"key": json.dumps("value"),
},
"hosts": ["foo.example.com"],
"https_redirect_status_code": 426,
"methods": ["..."],
"paths": ["..."],
"preserve_host": False,
"protocols": ["..."],
"regex_priority": 0,
"request_buffering": True,
"response_buffering": True,
"strip_path": True,
"tags": ["..."],
},
"server": {
"forward_client_headers": True,
"session": {
"client": {
"secrets": ["..."],
},
"managed": True,
"redis": {
"cloud_authentication": {
"azure": {
"client_id": "...my_client_id...",
"client_secret": "...my_client_secret...",
"tenant_id": "...my_tenant_id...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 1275755412,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "slave",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
"session_ttl": 86400,
"strategy": "redis",
},
"timeout": 10000,
},
"upstream": {
"auth": {
"aws": {
"access_key_id": "...my_access_key_id...",
"assume_role_arn": "...my_assume_role_arn...",
"region": "...my_region...",
"role_session_name": "...my_role_session_name...",
"secret_access_key": "...my_secret_access_key...",
"session_token": "...my_session_token...",
"sts_endpoint_url": "...my_sts_endpoint_url...",
},
},
},
"url": "https://mcp.internal.kongair.com",
},
"datastores": [{
"name": "shared-redis",
}],
"display_name": "Kong Air Flights",
"enabled": True,
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "kongair-flights",
"policies": ["..."],
"rate_limiting": {
"limits": [{
"limit": 100,
"method": "tools/call",
"tool": "search_flights",
"window_size": 60,
}],
},
"token_vault": {
"cache": {
"redis": {
"cloud_authentication": {
"aws": {
"access_key_id": "...my_access_key_id...",
"assume_role_arn": "...my_assume_role_arn...",
"cache_name": "...my_cache_name...",
"is_serverless": True,
"region": "...my_region...",
"role_session_name": "...my_role_session_name...",
"secret_access_key": "...my_secret_access_key...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 2020486820,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "master",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
},
"credential": {
"inbound": {
"location": "header",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
"outbound": {
"location": "query",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
},
"provider": "...my_provider...",
"subject_token_type": "access_token",
},
"tools": [{
"access": {
"acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
},
"annotations": {
"destructive_hint": True,
"idempotent_hint": False,
"open_world_hint": False,
"read_only_hint": True,
"title": "...my_title...",
},
"description": "Search for available flights",
"headers": "{ \"see\": \"documentation\" }",
"host": "...my_host...",
"method": "POST",
"name": "...my_name...",
"parameters": [{
"description": "The origin airport code.",
"in_": "query",
"name": "origin",
"required": True,
"schema": {
"key": json.dumps("value"),
},
}],
"path": "...my_path...",
"query": "{ \"see\": \"documentation\" }",
"request_body": "{ \"see\": \"documentation\" }",
"responses": "{ \"see\": \"documentation\" }",
"scheme": "https",
}],
},
conversion_only={
"config": {
"ca_certificates": ["my-ca-certificate"],
"certificates": ["my-certificate"],
"logging": {
"audits": False,
"payloads": False,
},
"max_request_body_size": 8388608,
"route": {
"headers": {
"key": json.dumps("value"),
},
"hosts": ["foo.example.com"],
"https_redirect_status_code": 426,
"methods": ["..."],
"paths": ["..."],
"preserve_host": False,
"protocols": ["..."],
"regex_priority": 0,
"request_buffering": True,
"response_buffering": True,
"strip_path": True,
"tags": ["..."],
},
"upstream": {
"auth": {
"aws": {
"access_key_id": "...my_access_key_id...",
"assume_role_arn": "...my_assume_role_arn...",
"region": "...my_region...",
"role_session_name": "...my_role_session_name...",
"secret_access_key": "...my_secret_access_key...",
"session_token": "...my_session_token...",
"sts_endpoint_url": "...my_sts_endpoint_url...",
},
},
},
"url": "https://mcp.internal.kongair.com",
},
"datastores": [{
"name": "shared-redis",
}],
"display_name": "Kong Air Flights",
"enabled": True,
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "kongair-flights",
"policies": ["..."],
"token_vault": {
"cache": {
"redis": {
"cloud_authentication": {
"gcp": {
"service_account_json": "...my_service_account_json...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 1023472511,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "slave",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
},
"credential": {
"inbound": {
"location": "query",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
"outbound": {
"location": "body",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
},
"provider": "...my_provider...",
"subject_token_type": "access_token",
},
"tools": [{
"access": {
"acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
},
"annotations": {
"destructive_hint": False,
"idempotent_hint": True,
"open_world_hint": True,
"read_only_hint": False,
"title": "...my_title...",
},
"description": "Search for available flights",
"headers": "{ \"see\": \"documentation\" }",
"host": "...my_host...",
"method": "PATCH",
"name": "...my_name...",
"parameters": [{
"description": "The origin airport code.",
"in_": "query",
"name": "origin",
"required": True,
"schema": {
"key": json.dumps("value"),
},
}],
"path": "...my_path...",
"query": "{ \"see\": \"documentation\" }",
"request_body": "{ \"see\": \"documentation\" }",
"responses": "{ \"see\": \"documentation\" }",
"scheme": "http",
}],
},
gateway_id="5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
listener={
"access": {
"oauth_access_token": {
"access_token_claim_field": "...my_access_token_claim_field...",
"acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
"auth_strategies": ["okta-ai-se"],
"default_tool_acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
"identity_providers": ["okta-ai-se"],
"metadata": {
"authorization_servers": ["..."],
"discovery_endpoint": "...my_discovery_endpoint...",
"endpoint": "...my_endpoint...",
"resource": "...my_resource...",
"scopes_supporteds": ["..."],
},
},
},
"config": {
"allowed_versions": ["2025-11-25"],
"cache": {
"discover": {
"cache_scope": "private",
"ttl_ms": 8,
},
"tools_list": {
"cache_scope": "private",
"ttl_ms": 6,
},
},
"logging": {
"audits": False,
"payloads": False,
},
"max_request_body_size": 8388608,
"route": {
"headers": {
"key": json.dumps("value"),
},
"hosts": ["foo.example.com"],
"https_redirect_status_code": 426,
"methods": ["..."],
"paths": ["..."],
"preserve_host": False,
"protocols": ["..."],
"regex_priority": 0,
"request_buffering": True,
"response_buffering": True,
"strip_path": True,
"tags": ["..."],
},
"server": {
"forward_client_headers": True,
"session": {
"client": {
"secrets": ["..."],
},
"managed": True,
"redis": {
"cloud_authentication": {
"gcp": {
"service_account_json": "...my_service_account_json...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 254844406,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "master",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
"session_ttl": 86400,
"strategy": "redis",
},
"timeout": 10000,
},
},
"datastores": [{
"name": "shared-redis",
}],
"display_name": "Kong Air Flights",
"enabled": True,
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "kongair-flights",
"policies": ["..."],
"sources": [
"kongair-flights",
"github-mcp",
],
"token_vault": {
"cache": {
"redis": {
"cloud_authentication": {
"aws": {
"access_key_id": "...my_access_key_id...",
"assume_role_arn": "...my_assume_role_arn...",
"cache_name": "...my_cache_name...",
"is_serverless": True,
"region": "...my_region...",
"role_session_name": "...my_role_session_name...",
"secret_access_key": "...my_secret_access_key...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 1304566812,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "master",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
},
"credential": {
"inbound": {
"location": "header",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
"outbound": {
"location": "query",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
},
"provider": "...my_provider...",
"subject_token_type": "api_key",
},
},
passthrough_listener={
"access": {
"consumer": {
"acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
"auth_strategies": ["okta-ai-se"],
"default_tool_acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
"identity_providers": ["okta-ai-se"],
"metadata": {
"authorization_servers": ["..."],
"discovery_endpoint": "...my_discovery_endpoint...",
"endpoint": "...my_endpoint...",
"resource": "...my_resource...",
"scopes_supporteds": ["..."],
},
},
},
"config": {
"ca_certificates": ["my-ca-certificate"],
"certificates": ["my-certificate"],
"logging": {
"audits": False,
"payloads": False,
},
"max_request_body_size": 8388608,
"proxy": {
"auth": {
"password": "...my_password...",
"username": "...my_username...",
},
"http_proxy": {
"host": "...my_host...",
"port": 43233,
},
"https_proxy": {
"host": "...my_host...",
"port": 31216,
},
"no_proxy": "...my_no_proxy...",
"proxy_scheme": "http",
},
"route": {
"headers": {
"key": json.dumps("value"),
},
"hosts": ["foo.example.com"],
"https_redirect_status_code": 426,
"methods": ["..."],
"paths": ["..."],
"preserve_host": False,
"protocols": ["..."],
"regex_priority": 0,
"request_buffering": True,
"response_buffering": True,
"strip_path": True,
"tags": ["..."],
},
"server": {
"forward_client_headers": True,
"session": {
"client": {
"secrets": ["..."],
},
"managed": True,
"redis": {
"cloud_authentication": {
"azure": {
"client_id": "...my_client_id...",
"client_secret": "...my_client_secret...",
"tenant_id": "...my_tenant_id...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 1750673053,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "any",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
"session_ttl": 86400,
"strategy": "redis",
},
"timeout": 10000,
},
"upstream": {
"auth": {
"aws": {
"access_key_id": "...my_access_key_id...",
"assume_role_arn": "...my_assume_role_arn...",
"region": "...my_region...",
"role_session_name": "...my_role_session_name...",
"secret_access_key": "...my_secret_access_key...",
"session_token": "...my_session_token...",
"sts_endpoint_url": "...my_sts_endpoint_url...",
},
},
},
"url": "https://mcp.internal.kongair.com",
},
"datastores": [{
"name": "shared-redis",
}],
"display_name": "Kong Air Flights",
"enabled": True,
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "kongair-flights",
"policies": ["..."],
"rate_limiting": {
"limits": [{
"limit": 100,
"method": "tools/call",
"tool": "search_flights",
"window_size": 60,
}],
},
"token_vault": {
"cache": {
"redis": {
"cloud_authentication": {
"gcp": {
"service_account_json": "...my_service_account_json...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 1262712627,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "any",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
},
"credential": {
"inbound": {
"location": "query",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
"outbound": {
"location": "header",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
},
"provider": "...my_provider...",
"subject_token_type": "api_key",
},
"tools": [{
"access": {
"acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
},
"name": "...my_name...",
}],
},
upstream_server={
"config": {
"ca_certificates": ["my-ca-certificate"],
"certificates": ["my-certificate"],
"logging": {
"audits": False,
"payloads": False,
},
"max_request_body_size": 8388608,
"route": {
"headers": {
"key": json.dumps("value"),
},
"hosts": ["foo.example.com"],
"https_redirect_status_code": 426,
"methods": ["..."],
"paths": ["..."],
"preserve_host": False,
"protocols": ["..."],
"regex_priority": 0,
"request_buffering": True,
"response_buffering": True,
"strip_path": True,
"tags": ["..."],
},
"server": {
"forward_client_headers": True,
"preserve_upstream_tool_names": False,
"session": {
"client": {
"secrets": ["..."],
},
"managed": True,
"redis": {
"cloud_authentication": {
"gcp": {
"service_account_json": "...my_service_account_json...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 176733398,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "master",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
"session_ttl": 86400,
"strategy": "redis",
},
"timeout": 10000,
"tools_list_auth": {
"jwt": {
"access_token_header": "Authorization",
"id_token_header": "...my_id_token_header...",
"scope": "...my_scope...",
},
},
"upstream_protocol_version": "2025-06-18",
},
"tools_cache_ttl_seconds": 7,
"upstream": {
"auth": {
"aws": {
"access_key_id": "...my_access_key_id...",
"assume_role_arn": "...my_assume_role_arn...",
"region": "...my_region...",
"role_session_name": "...my_role_session_name...",
"secret_access_key": "...my_secret_access_key...",
"session_token": "...my_session_token...",
"sts_endpoint_url": "...my_sts_endpoint_url...",
},
},
},
"url": "https://mcp.internal.kongair.com",
},
"datastores": [{
"name": "shared-redis",
}],
"display_name": "Kong Air Flights",
"enabled": True,
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "kongair-flights",
"policies": ["..."],
"token_vault": {
"cache": {
"redis": {
"cloud_authentication": {
"gcp": {
"service_account_json": "...my_service_account_json...",
},
},
"cluster": {
"max_redirections": 5,
"nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
},
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive": {
"backlog": 1008848731,
"pool_size": 256,
},
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel": {
"master": "...my_master...",
"nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"password": "...my_password...",
"role": "any",
"username": "...my_username...",
},
"server_name": "...my_server_name...",
"ssl": True,
"ssl_verify": True,
"username": "...my_username...",
},
},
"credential": {
"inbound": {
"location": "body",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
"outbound": {
"location": "header",
"name": "...my_name...",
"prefix": "...my_prefix...",
},
},
"provider": "...my_provider...",
"subject_token_type": "api_key",
},
"tools": [{
"access": {
"acls": {
"allows": ["..."],
"allow_whens": ["..."],
"denies": ["..."],
"deny_whens": ["..."],
},
},
"annotations": {
"destructive_hint": True,
"idempotent_hint": True,
"open_world_hint": False,
"read_only_hint": True,
"title": "...my_title...",
},
"description": "Search for available flights",
"input_schema": "{ \"see\": \"documentation\" }",
"name": "...my_name...",
"output_schema": "{ \"see\": \"documentation\" }",
}],
})
package main
import (
"encoding/json"
"github.com/pulumi/pulumi-terraform-provider/sdks/go/konnect/v3/konnect"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
tmpJSON0, err := json.Marshal("value")
if err != nil {
return err
}
json0 := string(tmpJSON0)
tmpJSON1, err := json.Marshal("value")
if err != nil {
return err
}
json1 := string(tmpJSON1)
tmpJSON2, err := json.Marshal("value")
if err != nil {
return err
}
json2 := string(tmpJSON2)
tmpJSON3, err := json.Marshal("value")
if err != nil {
return err
}
json3 := string(tmpJSON3)
tmpJSON4, err := json.Marshal("value")
if err != nil {
return err
}
json4 := string(tmpJSON4)
tmpJSON5, err := json.Marshal("value")
if err != nil {
return err
}
json5 := string(tmpJSON5)
tmpJSON6, err := json.Marshal("value")
if err != nil {
return err
}
json6 := string(tmpJSON6)
_, err = konnect.NewAiGatewayMcpServer(ctx, "my_aigatewaymcpserver", &konnect.AiGatewayMcpServerArgs{
ConversionListener: &konnect.AiGatewayMcpServerConversionListenerArgs{
Access: &konnect.AiGatewayMcpServerConversionListenerAccessArgs{
OauthAccessToken: &konnect.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenArgs{
AccessTokenClaimField: pulumi.String("...my_access_token_claim_field..."),
Acls: &konnect.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
AuthStrategies: pulumi.StringArray{
pulumi.String("okta-ai-se"),
},
DefaultToolAcls: &konnect.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenDefaultToolAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
IdentityProviders: pulumi.StringArray{
pulumi.String("okta-ai-se"),
},
Metadata: &konnect.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenMetadataArgs{
AuthorizationServers: pulumi.StringArray{
pulumi.String("..."),
},
DiscoveryEndpoint: pulumi.String("...my_discovery_endpoint..."),
Endpoint: pulumi.String("...my_endpoint..."),
Resource: pulumi.String("...my_resource..."),
ScopesSupporteds: pulumi.StringArray{
pulumi.String("..."),
},
},
},
},
Config: &konnect.AiGatewayMcpServerConversionListenerConfigArgs{
AllowedVersions: pulumi.StringArray{
pulumi.String("2025-06-18"),
},
CaCertificates: pulumi.StringArray{
pulumi.String("my-ca-certificate"),
},
Cache: &konnect.AiGatewayMcpServerConversionListenerConfigCacheArgs{
Discover: &konnect.AiGatewayMcpServerConversionListenerConfigCacheDiscoverArgs{
CacheScope: pulumi.String("private"),
TtlMs: pulumi.Float64(5),
},
ToolsList: &konnect.AiGatewayMcpServerConversionListenerConfigCacheToolsListArgs{
CacheScope: pulumi.String("private"),
TtlMs: pulumi.Float64(1),
},
},
Certificates: pulumi.StringArray{
pulumi.String("my-certificate"),
},
Logging: &konnect.AiGatewayMcpServerConversionListenerConfigLoggingArgs{
Audits: pulumi.Bool(false),
Payloads: pulumi.Bool(false),
},
MaxRequestBodySize: pulumi.Float64(8388608),
Route: &konnect.AiGatewayMcpServerConversionListenerConfigRouteArgs{
Headers: pulumi.StringMap{
"key": pulumi.String(json0),
},
Hosts: pulumi.StringArray{
pulumi.String("foo.example.com"),
},
HttpsRedirectStatusCode: pulumi.Float64(426),
Methods: pulumi.StringArray{
pulumi.String("..."),
},
Paths: pulumi.StringArray{
pulumi.String("..."),
},
PreserveHost: pulumi.Bool(false),
Protocols: pulumi.StringArray{
pulumi.String("..."),
},
RegexPriority: pulumi.Float64(0),
RequestBuffering: pulumi.Bool(true),
ResponseBuffering: pulumi.Bool(true),
StripPath: pulumi.Bool(true),
Tags: pulumi.StringArray{
pulumi.String("..."),
},
},
Server: &konnect.AiGatewayMcpServerConversionListenerConfigServerArgs{
ForwardClientHeaders: pulumi.Bool(true),
Session: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionArgs{
Client: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionClientArgs{
Secrets: pulumi.StringArray{
pulumi.String("..."),
},
},
Managed: pulumi.Bool(true),
Redis: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationArgs{
Azure: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAzureArgs{
ClientId: pulumi.String("...my_client_id..."),
ClientSecret: pulumi.String("...my_client_secret..."),
TenantId: pulumi.String("...my_tenant_id..."),
},
},
Cluster: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterNodeArray{
&konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisKeepaliveArgs{
Backlog: pulumi.Float64(1275755412),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("slave"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
SessionTtl: pulumi.Float64(86400),
Strategy: pulumi.String("redis"),
},
Timeout: pulumi.Float64(10000),
},
Upstream: &konnect.AiGatewayMcpServerConversionListenerConfigUpstreamArgs{
Auth: &konnect.AiGatewayMcpServerConversionListenerConfigUpstreamAuthArgs{
Aws: &konnect.AiGatewayMcpServerConversionListenerConfigUpstreamAuthAwsArgs{
AccessKeyId: pulumi.String("...my_access_key_id..."),
AssumeRoleArn: pulumi.String("...my_assume_role_arn..."),
Region: pulumi.String("...my_region..."),
RoleSessionName: pulumi.String("...my_role_session_name..."),
SecretAccessKey: pulumi.String("...my_secret_access_key..."),
SessionToken: pulumi.String("...my_session_token..."),
StsEndpointUrl: pulumi.String("...my_sts_endpoint_url..."),
},
},
},
Url: pulumi.String("https://mcp.internal.kongair.com"),
},
Datastores: konnect.AiGatewayMcpServerConversionListenerDatastoreArray{
&konnect.AiGatewayMcpServerConversionListenerDatastoreArgs{
Name: pulumi.String("shared-redis"),
},
},
DisplayName: pulumi.String("Kong Air Flights"),
Enabled: pulumi.Bool(true),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("kongair-flights"),
Policies: pulumi.StringArray{
pulumi.String("..."),
},
RateLimiting: &konnect.AiGatewayMcpServerConversionListenerRateLimitingArgs{
Limits: konnect.AiGatewayMcpServerConversionListenerRateLimitingLimitArray{
&konnect.AiGatewayMcpServerConversionListenerRateLimitingLimitArgs{
Limit: pulumi.Float64(100),
Method: pulumi.String("tools/call"),
Tool: pulumi.String("search_flights"),
WindowSize: pulumi.Float64(60),
},
},
},
TokenVault: &konnect.AiGatewayMcpServerConversionListenerTokenVaultArgs{
Cache: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheArgs{
Redis: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationArgs{
Aws: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs{
AccessKeyId: pulumi.String("...my_access_key_id..."),
AssumeRoleArn: pulumi.String("...my_assume_role_arn..."),
CacheName: pulumi.String("...my_cache_name..."),
IsServerless: pulumi.Bool(true),
Region: pulumi.String("...my_region..."),
RoleSessionName: pulumi.String("...my_role_session_name..."),
SecretAccessKey: pulumi.String("...my_secret_access_key..."),
},
},
Cluster: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterNodeArray{
&konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisKeepaliveArgs{
Backlog: pulumi.Float64(2020486820),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("master"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
},
Credential: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCredentialArgs{
Inbound: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCredentialInboundArgs{
Location: pulumi.String("header"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
Outbound: &konnect.AiGatewayMcpServerConversionListenerTokenVaultCredentialOutboundArgs{
Location: pulumi.String("query"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
},
Provider: pulumi.String("...my_provider..."),
SubjectTokenType: pulumi.String("access_token"),
},
Tools: konnect.AiGatewayMcpServerConversionListenerToolArray{
&konnect.AiGatewayMcpServerConversionListenerToolArgs{
Access: &konnect.AiGatewayMcpServerConversionListenerToolAccessArgs{
Acls: &konnect.AiGatewayMcpServerConversionListenerToolAccessAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
},
Annotations: &konnect.AiGatewayMcpServerConversionListenerToolAnnotationsArgs{
DestructiveHint: pulumi.Bool(true),
IdempotentHint: pulumi.Bool(false),
OpenWorldHint: pulumi.Bool(false),
ReadOnlyHint: pulumi.Bool(true),
Title: pulumi.String("...my_title..."),
},
Description: pulumi.String("Search for available flights"),
Headers: pulumi.String("{ \"see\": \"documentation\" }"),
Host: pulumi.String("...my_host..."),
Method: pulumi.String("POST"),
Name: pulumi.String("...my_name..."),
Parameters: konnect.AiGatewayMcpServerConversionListenerToolParameterArray{
&konnect.AiGatewayMcpServerConversionListenerToolParameterArgs{
Description: pulumi.String("The origin airport code."),
In: pulumi.String("query"),
Name: pulumi.String("origin"),
Required: pulumi.Bool(true),
Schema: pulumi.StringMap{
"key": pulumi.String(json1),
},
},
},
Path: pulumi.String("...my_path..."),
Query: pulumi.String("{ \"see\": \"documentation\" }"),
RequestBody: pulumi.String("{ \"see\": \"documentation\" }"),
Responses: pulumi.String("{ \"see\": \"documentation\" }"),
Scheme: pulumi.String("https"),
},
},
},
ConversionOnly: &konnect.AiGatewayMcpServerConversionOnlyArgs{
Config: &konnect.AiGatewayMcpServerConversionOnlyConfigArgs{
CaCertificates: pulumi.StringArray{
pulumi.String("my-ca-certificate"),
},
Certificates: pulumi.StringArray{
pulumi.String("my-certificate"),
},
Logging: &konnect.AiGatewayMcpServerConversionOnlyConfigLoggingArgs{
Audits: pulumi.Bool(false),
Payloads: pulumi.Bool(false),
},
MaxRequestBodySize: pulumi.Float64(8388608),
Route: &konnect.AiGatewayMcpServerConversionOnlyConfigRouteArgs{
Headers: pulumi.StringMap{
"key": pulumi.String(json2),
},
Hosts: pulumi.StringArray{
pulumi.String("foo.example.com"),
},
HttpsRedirectStatusCode: pulumi.Float64(426),
Methods: pulumi.StringArray{
pulumi.String("..."),
},
Paths: pulumi.StringArray{
pulumi.String("..."),
},
PreserveHost: pulumi.Bool(false),
Protocols: pulumi.StringArray{
pulumi.String("..."),
},
RegexPriority: pulumi.Float64(0),
RequestBuffering: pulumi.Bool(true),
ResponseBuffering: pulumi.Bool(true),
StripPath: pulumi.Bool(true),
Tags: pulumi.StringArray{
pulumi.String("..."),
},
},
Upstream: &konnect.AiGatewayMcpServerConversionOnlyConfigUpstreamArgs{
Auth: &konnect.AiGatewayMcpServerConversionOnlyConfigUpstreamAuthArgs{
Aws: &konnect.AiGatewayMcpServerConversionOnlyConfigUpstreamAuthAwsArgs{
AccessKeyId: pulumi.String("...my_access_key_id..."),
AssumeRoleArn: pulumi.String("...my_assume_role_arn..."),
Region: pulumi.String("...my_region..."),
RoleSessionName: pulumi.String("...my_role_session_name..."),
SecretAccessKey: pulumi.String("...my_secret_access_key..."),
SessionToken: pulumi.String("...my_session_token..."),
StsEndpointUrl: pulumi.String("...my_sts_endpoint_url..."),
},
},
},
Url: pulumi.String("https://mcp.internal.kongair.com"),
},
Datastores: konnect.AiGatewayMcpServerConversionOnlyDatastoreArray{
&konnect.AiGatewayMcpServerConversionOnlyDatastoreArgs{
Name: pulumi.String("shared-redis"),
},
},
DisplayName: pulumi.String("Kong Air Flights"),
Enabled: pulumi.Bool(true),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("kongair-flights"),
Policies: pulumi.StringArray{
pulumi.String("..."),
},
TokenVault: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultArgs{
Cache: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheArgs{
Redis: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationArgs{
Gcp: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationGcpArgs{
ServiceAccountJson: pulumi.String("...my_service_account_json..."),
},
},
Cluster: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterNodeArray{
&konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisKeepaliveArgs{
Backlog: pulumi.Float64(1023472511),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("slave"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
},
Credential: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCredentialArgs{
Inbound: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCredentialInboundArgs{
Location: pulumi.String("query"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
Outbound: &konnect.AiGatewayMcpServerConversionOnlyTokenVaultCredentialOutboundArgs{
Location: pulumi.String("body"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
},
Provider: pulumi.String("...my_provider..."),
SubjectTokenType: pulumi.String("access_token"),
},
Tools: konnect.AiGatewayMcpServerConversionOnlyToolArray{
&konnect.AiGatewayMcpServerConversionOnlyToolArgs{
Access: &konnect.AiGatewayMcpServerConversionOnlyToolAccessArgs{
Acls: &konnect.AiGatewayMcpServerConversionOnlyToolAccessAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
},
Annotations: &konnect.AiGatewayMcpServerConversionOnlyToolAnnotationsArgs{
DestructiveHint: pulumi.Bool(false),
IdempotentHint: pulumi.Bool(true),
OpenWorldHint: pulumi.Bool(true),
ReadOnlyHint: pulumi.Bool(false),
Title: pulumi.String("...my_title..."),
},
Description: pulumi.String("Search for available flights"),
Headers: pulumi.String("{ \"see\": \"documentation\" }"),
Host: pulumi.String("...my_host..."),
Method: pulumi.String("PATCH"),
Name: pulumi.String("...my_name..."),
Parameters: konnect.AiGatewayMcpServerConversionOnlyToolParameterArray{
&konnect.AiGatewayMcpServerConversionOnlyToolParameterArgs{
Description: pulumi.String("The origin airport code."),
In: pulumi.String("query"),
Name: pulumi.String("origin"),
Required: pulumi.Bool(true),
Schema: pulumi.StringMap{
"key": pulumi.String(json3),
},
},
},
Path: pulumi.String("...my_path..."),
Query: pulumi.String("{ \"see\": \"documentation\" }"),
RequestBody: pulumi.String("{ \"see\": \"documentation\" }"),
Responses: pulumi.String("{ \"see\": \"documentation\" }"),
Scheme: pulumi.String("http"),
},
},
},
GatewayId: pulumi.String("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"),
Listener: &konnect.AiGatewayMcpServerListenerArgs{
Access: &konnect.AiGatewayMcpServerListenerAccessArgs{
OauthAccessToken: &konnect.AiGatewayMcpServerListenerAccessOauthAccessTokenArgs{
AccessTokenClaimField: pulumi.String("...my_access_token_claim_field..."),
Acls: &konnect.AiGatewayMcpServerListenerAccessOauthAccessTokenAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
AuthStrategies: pulumi.StringArray{
pulumi.String("okta-ai-se"),
},
DefaultToolAcls: &konnect.AiGatewayMcpServerListenerAccessOauthAccessTokenDefaultToolAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
IdentityProviders: pulumi.StringArray{
pulumi.String("okta-ai-se"),
},
Metadata: &konnect.AiGatewayMcpServerListenerAccessOauthAccessTokenMetadataArgs{
AuthorizationServers: pulumi.StringArray{
pulumi.String("..."),
},
DiscoveryEndpoint: pulumi.String("...my_discovery_endpoint..."),
Endpoint: pulumi.String("...my_endpoint..."),
Resource: pulumi.String("...my_resource..."),
ScopesSupporteds: pulumi.StringArray{
pulumi.String("..."),
},
},
},
},
Config: &konnect.AiGatewayMcpServerListenerConfigArgs{
AllowedVersions: pulumi.StringArray{
pulumi.String("2025-11-25"),
},
Cache: &konnect.AiGatewayMcpServerListenerConfigCacheArgs{
Discover: &konnect.AiGatewayMcpServerListenerConfigCacheDiscoverArgs{
CacheScope: pulumi.String("private"),
TtlMs: pulumi.Float64(8),
},
ToolsList: &konnect.AiGatewayMcpServerListenerConfigCacheToolsListArgs{
CacheScope: pulumi.String("private"),
TtlMs: pulumi.Float64(6),
},
},
Logging: &konnect.AiGatewayMcpServerListenerConfigLoggingArgs{
Audits: pulumi.Bool(false),
Payloads: pulumi.Bool(false),
},
MaxRequestBodySize: pulumi.Float64(8388608),
Route: &konnect.AiGatewayMcpServerListenerConfigRouteArgs{
Headers: pulumi.StringMap{
"key": pulumi.String(json4),
},
Hosts: pulumi.StringArray{
pulumi.String("foo.example.com"),
},
HttpsRedirectStatusCode: pulumi.Float64(426),
Methods: pulumi.StringArray{
pulumi.String("..."),
},
Paths: pulumi.StringArray{
pulumi.String("..."),
},
PreserveHost: pulumi.Bool(false),
Protocols: pulumi.StringArray{
pulumi.String("..."),
},
RegexPriority: pulumi.Float64(0),
RequestBuffering: pulumi.Bool(true),
ResponseBuffering: pulumi.Bool(true),
StripPath: pulumi.Bool(true),
Tags: pulumi.StringArray{
pulumi.String("..."),
},
},
Server: &konnect.AiGatewayMcpServerListenerConfigServerArgs{
ForwardClientHeaders: pulumi.Bool(true),
Session: &konnect.AiGatewayMcpServerListenerConfigServerSessionArgs{
Client: &konnect.AiGatewayMcpServerListenerConfigServerSessionClientArgs{
Secrets: pulumi.StringArray{
pulumi.String("..."),
},
},
Managed: pulumi.Bool(true),
Redis: &konnect.AiGatewayMcpServerListenerConfigServerSessionRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationArgs{
Gcp: &konnect.AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationGcpArgs{
ServiceAccountJson: pulumi.String("...my_service_account_json..."),
},
},
Cluster: &konnect.AiGatewayMcpServerListenerConfigServerSessionRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerListenerConfigServerSessionRedisClusterNodeArray{
&konnect.AiGatewayMcpServerListenerConfigServerSessionRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerListenerConfigServerSessionRedisKeepaliveArgs{
Backlog: pulumi.Float64(254844406),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerListenerConfigServerSessionRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerListenerConfigServerSessionRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerListenerConfigServerSessionRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("master"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
SessionTtl: pulumi.Float64(86400),
Strategy: pulumi.String("redis"),
},
Timeout: pulumi.Float64(10000),
},
},
Datastores: konnect.AiGatewayMcpServerListenerDatastoreArray{
&konnect.AiGatewayMcpServerListenerDatastoreArgs{
Name: pulumi.String("shared-redis"),
},
},
DisplayName: pulumi.String("Kong Air Flights"),
Enabled: pulumi.Bool(true),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("kongair-flights"),
Policies: pulumi.StringArray{
pulumi.String("..."),
},
Sources: pulumi.StringArray{
pulumi.String("kongair-flights"),
pulumi.String("github-mcp"),
},
TokenVault: &konnect.AiGatewayMcpServerListenerTokenVaultArgs{
Cache: &konnect.AiGatewayMcpServerListenerTokenVaultCacheArgs{
Redis: &konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationArgs{
Aws: &konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs{
AccessKeyId: pulumi.String("...my_access_key_id..."),
AssumeRoleArn: pulumi.String("...my_assume_role_arn..."),
CacheName: pulumi.String("...my_cache_name..."),
IsServerless: pulumi.Bool(true),
Region: pulumi.String("...my_region..."),
RoleSessionName: pulumi.String("...my_role_session_name..."),
SecretAccessKey: pulumi.String("...my_secret_access_key..."),
},
},
Cluster: &konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisClusterNodeArray{
&konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisKeepaliveArgs{
Backlog: pulumi.Float64(1304566812),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("master"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
},
Credential: &konnect.AiGatewayMcpServerListenerTokenVaultCredentialArgs{
Inbound: &konnect.AiGatewayMcpServerListenerTokenVaultCredentialInboundArgs{
Location: pulumi.String("header"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
Outbound: &konnect.AiGatewayMcpServerListenerTokenVaultCredentialOutboundArgs{
Location: pulumi.String("query"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
},
Provider: pulumi.String("...my_provider..."),
SubjectTokenType: pulumi.String("api_key"),
},
},
PassthroughListener: &konnect.AiGatewayMcpServerPassthroughListenerArgs{
Access: &konnect.AiGatewayMcpServerPassthroughListenerAccessArgs{
Consumer: &konnect.AiGatewayMcpServerPassthroughListenerAccessConsumerArgs{
Acls: &konnect.AiGatewayMcpServerPassthroughListenerAccessConsumerAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
AuthStrategies: pulumi.StringArray{
pulumi.String("okta-ai-se"),
},
DefaultToolAcls: &konnect.AiGatewayMcpServerPassthroughListenerAccessConsumerDefaultToolAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
IdentityProviders: pulumi.StringArray{
pulumi.String("okta-ai-se"),
},
Metadata: &konnect.AiGatewayMcpServerPassthroughListenerAccessConsumerMetadataArgs{
AuthorizationServers: pulumi.StringArray{
pulumi.String("..."),
},
DiscoveryEndpoint: pulumi.String("...my_discovery_endpoint..."),
Endpoint: pulumi.String("...my_endpoint..."),
Resource: pulumi.String("...my_resource..."),
ScopesSupporteds: pulumi.StringArray{
pulumi.String("..."),
},
},
},
},
Config: &konnect.AiGatewayMcpServerPassthroughListenerConfigArgs{
CaCertificates: pulumi.StringArray{
pulumi.String("my-ca-certificate"),
},
Certificates: pulumi.StringArray{
pulumi.String("my-certificate"),
},
Logging: &konnect.AiGatewayMcpServerPassthroughListenerConfigLoggingArgs{
Audits: pulumi.Bool(false),
Payloads: pulumi.Bool(false),
},
MaxRequestBodySize: pulumi.Float64(8388608),
Proxy: &konnect.AiGatewayMcpServerPassthroughListenerConfigProxyArgs{
Auth: &konnect.AiGatewayMcpServerPassthroughListenerConfigProxyAuthArgs{
Password: pulumi.String("...my_password..."),
Username: pulumi.String("...my_username..."),
},
HttpProxy: &konnect.AiGatewayMcpServerPassthroughListenerConfigProxyHttpProxyArgs{
Host: pulumi.String("...my_host..."),
Port: pulumi.Float64(43233),
},
HttpsProxy: &konnect.AiGatewayMcpServerPassthroughListenerConfigProxyHttpsProxyArgs{
Host: pulumi.String("...my_host..."),
Port: pulumi.Float64(31216),
},
NoProxy: pulumi.String("...my_no_proxy..."),
ProxyScheme: pulumi.String("http"),
},
Route: &konnect.AiGatewayMcpServerPassthroughListenerConfigRouteArgs{
Headers: pulumi.StringMap{
"key": pulumi.String(json5),
},
Hosts: pulumi.StringArray{
pulumi.String("foo.example.com"),
},
HttpsRedirectStatusCode: pulumi.Float64(426),
Methods: pulumi.StringArray{
pulumi.String("..."),
},
Paths: pulumi.StringArray{
pulumi.String("..."),
},
PreserveHost: pulumi.Bool(false),
Protocols: pulumi.StringArray{
pulumi.String("..."),
},
RegexPriority: pulumi.Float64(0),
RequestBuffering: pulumi.Bool(true),
ResponseBuffering: pulumi.Bool(true),
StripPath: pulumi.Bool(true),
Tags: pulumi.StringArray{
pulumi.String("..."),
},
},
Server: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerArgs{
ForwardClientHeaders: pulumi.Bool(true),
Session: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionArgs{
Client: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionClientArgs{
Secrets: pulumi.StringArray{
pulumi.String("..."),
},
},
Managed: pulumi.Bool(true),
Redis: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationArgs{
Azure: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAzureArgs{
ClientId: pulumi.String("...my_client_id..."),
ClientSecret: pulumi.String("...my_client_secret..."),
TenantId: pulumi.String("...my_tenant_id..."),
},
},
Cluster: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterNodeArray{
&konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisKeepaliveArgs{
Backlog: pulumi.Float64(1750673053),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("any"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
SessionTtl: pulumi.Float64(86400),
Strategy: pulumi.String("redis"),
},
Timeout: pulumi.Float64(10000),
},
Upstream: &konnect.AiGatewayMcpServerPassthroughListenerConfigUpstreamArgs{
Auth: &konnect.AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthArgs{
Aws: &konnect.AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthAwsArgs{
AccessKeyId: pulumi.String("...my_access_key_id..."),
AssumeRoleArn: pulumi.String("...my_assume_role_arn..."),
Region: pulumi.String("...my_region..."),
RoleSessionName: pulumi.String("...my_role_session_name..."),
SecretAccessKey: pulumi.String("...my_secret_access_key..."),
SessionToken: pulumi.String("...my_session_token..."),
StsEndpointUrl: pulumi.String("...my_sts_endpoint_url..."),
},
},
},
Url: pulumi.String("https://mcp.internal.kongair.com"),
},
Datastores: konnect.AiGatewayMcpServerPassthroughListenerDatastoreArray{
&konnect.AiGatewayMcpServerPassthroughListenerDatastoreArgs{
Name: pulumi.String("shared-redis"),
},
},
DisplayName: pulumi.String("Kong Air Flights"),
Enabled: pulumi.Bool(true),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("kongair-flights"),
Policies: pulumi.StringArray{
pulumi.String("..."),
},
RateLimiting: &konnect.AiGatewayMcpServerPassthroughListenerRateLimitingArgs{
Limits: konnect.AiGatewayMcpServerPassthroughListenerRateLimitingLimitArray{
&konnect.AiGatewayMcpServerPassthroughListenerRateLimitingLimitArgs{
Limit: pulumi.Float64(100),
Method: pulumi.String("tools/call"),
Tool: pulumi.String("search_flights"),
WindowSize: pulumi.Float64(60),
},
},
},
TokenVault: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultArgs{
Cache: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheArgs{
Redis: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationArgs{
Gcp: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationGcpArgs{
ServiceAccountJson: pulumi.String("...my_service_account_json..."),
},
},
Cluster: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterNodeArray{
&konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisKeepaliveArgs{
Backlog: pulumi.Float64(1262712627),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("any"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
},
Credential: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialArgs{
Inbound: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialInboundArgs{
Location: pulumi.String("query"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
Outbound: &konnect.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialOutboundArgs{
Location: pulumi.String("header"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
},
Provider: pulumi.String("...my_provider..."),
SubjectTokenType: pulumi.String("api_key"),
},
Tools: konnect.AiGatewayMcpServerPassthroughListenerToolArray{
&konnect.AiGatewayMcpServerPassthroughListenerToolArgs{
Access: &konnect.AiGatewayMcpServerPassthroughListenerToolAccessArgs{
Acls: &konnect.AiGatewayMcpServerPassthroughListenerToolAccessAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
},
Name: pulumi.String("...my_name..."),
},
},
},
UpstreamServer: &konnect.AiGatewayMcpServerUpstreamServerArgs{
Config: &konnect.AiGatewayMcpServerUpstreamServerConfigArgs{
CaCertificates: pulumi.StringArray{
pulumi.String("my-ca-certificate"),
},
Certificates: pulumi.StringArray{
pulumi.String("my-certificate"),
},
Logging: &konnect.AiGatewayMcpServerUpstreamServerConfigLoggingArgs{
Audits: pulumi.Bool(false),
Payloads: pulumi.Bool(false),
},
MaxRequestBodySize: pulumi.Float64(8388608),
Route: &konnect.AiGatewayMcpServerUpstreamServerConfigRouteArgs{
Headers: pulumi.StringMap{
"key": pulumi.String(json6),
},
Hosts: pulumi.StringArray{
pulumi.String("foo.example.com"),
},
HttpsRedirectStatusCode: pulumi.Float64(426),
Methods: pulumi.StringArray{
pulumi.String("..."),
},
Paths: pulumi.StringArray{
pulumi.String("..."),
},
PreserveHost: pulumi.Bool(false),
Protocols: pulumi.StringArray{
pulumi.String("..."),
},
RegexPriority: pulumi.Float64(0),
RequestBuffering: pulumi.Bool(true),
ResponseBuffering: pulumi.Bool(true),
StripPath: pulumi.Bool(true),
Tags: pulumi.StringArray{
pulumi.String("..."),
},
},
Server: &konnect.AiGatewayMcpServerUpstreamServerConfigServerArgs{
ForwardClientHeaders: pulumi.Bool(true),
PreserveUpstreamToolNames: pulumi.Bool(false),
Session: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionArgs{
Client: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionClientArgs{
Secrets: pulumi.StringArray{
pulumi.String("..."),
},
},
Managed: pulumi.Bool(true),
Redis: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationArgs{
Gcp: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationGcpArgs{
ServiceAccountJson: pulumi.String("...my_service_account_json..."),
},
},
Cluster: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterNodeArray{
&konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisKeepaliveArgs{
Backlog: pulumi.Float64(176733398),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("master"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
SessionTtl: pulumi.Float64(86400),
Strategy: pulumi.String("redis"),
},
Timeout: pulumi.Float64(10000),
ToolsListAuth: &konnect.AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthArgs{
Jwt: &konnect.AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthJwtArgs{
AccessTokenHeader: pulumi.String("Authorization"),
IdTokenHeader: pulumi.String("...my_id_token_header..."),
Scope: pulumi.String("...my_scope..."),
},
},
UpstreamProtocolVersion: pulumi.String("2025-06-18"),
},
ToolsCacheTtlSeconds: pulumi.Float64(7),
Upstream: &konnect.AiGatewayMcpServerUpstreamServerConfigUpstreamArgs{
Auth: &konnect.AiGatewayMcpServerUpstreamServerConfigUpstreamAuthArgs{
Aws: &konnect.AiGatewayMcpServerUpstreamServerConfigUpstreamAuthAwsArgs{
AccessKeyId: pulumi.String("...my_access_key_id..."),
AssumeRoleArn: pulumi.String("...my_assume_role_arn..."),
Region: pulumi.String("...my_region..."),
RoleSessionName: pulumi.String("...my_role_session_name..."),
SecretAccessKey: pulumi.String("...my_secret_access_key..."),
SessionToken: pulumi.String("...my_session_token..."),
StsEndpointUrl: pulumi.String("...my_sts_endpoint_url..."),
},
},
},
Url: pulumi.String("https://mcp.internal.kongair.com"),
},
Datastores: konnect.AiGatewayMcpServerUpstreamServerDatastoreArray{
&konnect.AiGatewayMcpServerUpstreamServerDatastoreArgs{
Name: pulumi.String("shared-redis"),
},
},
DisplayName: pulumi.String("Kong Air Flights"),
Enabled: pulumi.Bool(true),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("kongair-flights"),
Policies: pulumi.StringArray{
pulumi.String("..."),
},
TokenVault: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultArgs{
Cache: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheArgs{
Redis: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisArgs{
CloudAuthentication: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationArgs{
Gcp: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationGcpArgs{
ServiceAccountJson: pulumi.String("...my_service_account_json..."),
},
},
Cluster: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterArgs{
MaxRedirections: pulumi.Float64(5),
Nodes: konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterNodeArray{
&konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
Keepalive: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisKeepaliveArgs{
Backlog: pulumi.Float64(1008848731),
PoolSize: pulumi.Float64(256),
},
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
Sentinel: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelArgs{
Master: pulumi.String("...my_master..."),
Nodes: konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelNodeArray{
&konnect.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
Password: pulumi.String("...my_password..."),
Role: pulumi.String("any"),
Username: pulumi.String("...my_username..."),
},
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(true),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
},
Credential: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCredentialArgs{
Inbound: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCredentialInboundArgs{
Location: pulumi.String("body"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
Outbound: &konnect.AiGatewayMcpServerUpstreamServerTokenVaultCredentialOutboundArgs{
Location: pulumi.String("header"),
Name: pulumi.String("...my_name..."),
Prefix: pulumi.String("...my_prefix..."),
},
},
Provider: pulumi.String("...my_provider..."),
SubjectTokenType: pulumi.String("api_key"),
},
Tools: konnect.AiGatewayMcpServerUpstreamServerToolArray{
&konnect.AiGatewayMcpServerUpstreamServerToolArgs{
Access: &konnect.AiGatewayMcpServerUpstreamServerToolAccessArgs{
Acls: &konnect.AiGatewayMcpServerUpstreamServerToolAccessAclsArgs{
Allows: pulumi.StringArray{
pulumi.String("..."),
},
AllowWhens: pulumi.StringArray{
pulumi.String("..."),
},
Denies: pulumi.StringArray{
pulumi.String("..."),
},
DenyWhens: pulumi.StringArray{
pulumi.String("..."),
},
},
},
Annotations: &konnect.AiGatewayMcpServerUpstreamServerToolAnnotationsArgs{
DestructiveHint: pulumi.Bool(true),
IdempotentHint: pulumi.Bool(true),
OpenWorldHint: pulumi.Bool(false),
ReadOnlyHint: pulumi.Bool(true),
Title: pulumi.String("...my_title..."),
},
Description: pulumi.String("Search for available flights"),
InputSchema: pulumi.String("{ \"see\": \"documentation\" }"),
Name: pulumi.String("...my_name..."),
OutputSchema: pulumi.String("{ \"see\": \"documentation\" }"),
},
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Konnect = Pulumi.Konnect;
return await Deployment.RunAsync(() =>
{
var myAigatewaymcpserver = new Konnect.AiGatewayMcpServer("my_aigatewaymcpserver", new()
{
ConversionListener = new Konnect.Inputs.AiGatewayMcpServerConversionListenerArgs
{
Access = new Konnect.Inputs.AiGatewayMcpServerConversionListenerAccessArgs
{
OauthAccessToken = new Konnect.Inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenArgs
{
AccessTokenClaimField = "...my_access_token_claim_field...",
Acls = new Konnect.Inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
AuthStrategies = new[]
{
"okta-ai-se",
},
DefaultToolAcls = new Konnect.Inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenDefaultToolAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
IdentityProviders = new[]
{
"okta-ai-se",
},
Metadata = new Konnect.Inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenMetadataArgs
{
AuthorizationServers = new[]
{
"...",
},
DiscoveryEndpoint = "...my_discovery_endpoint...",
Endpoint = "...my_endpoint...",
Resource = "...my_resource...",
ScopesSupporteds = new[]
{
"...",
},
},
},
},
Config = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigArgs
{
AllowedVersions = new[]
{
"2025-06-18",
},
CaCertificates = new[]
{
"my-ca-certificate",
},
Cache = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigCacheArgs
{
Discover = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigCacheDiscoverArgs
{
CacheScope = "private",
TtlMs = 5,
},
ToolsList = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigCacheToolsListArgs
{
CacheScope = "private",
TtlMs = 1,
},
},
Certificates = new[]
{
"my-certificate",
},
Logging = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigLoggingArgs
{
Audits = false,
Payloads = false,
},
MaxRequestBodySize = 8388608,
Route = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigRouteArgs
{
Headers =
{
{ "key", JsonSerializer.Serialize("value") },
},
Hosts = new[]
{
"foo.example.com",
},
HttpsRedirectStatusCode = 426,
Methods = new[]
{
"...",
},
Paths = new[]
{
"...",
},
PreserveHost = false,
Protocols = new[]
{
"...",
},
RegexPriority = 0,
RequestBuffering = true,
ResponseBuffering = true,
StripPath = true,
Tags = new[]
{
"...",
},
},
Server = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerArgs
{
ForwardClientHeaders = true,
Session = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionArgs
{
Client = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionClientArgs
{
Secrets = new[]
{
"...",
},
},
Managed = true,
Redis = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationArgs
{
Azure = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAzureArgs
{
ClientId = "...my_client_id...",
ClientSecret = "...my_client_secret...",
TenantId = "...my_tenant_id...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisKeepaliveArgs
{
Backlog = 1275755412,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "slave",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
SessionTtl = 86400,
Strategy = "redis",
},
Timeout = 10000,
},
Upstream = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigUpstreamArgs
{
Auth = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigUpstreamAuthArgs
{
Aws = new Konnect.Inputs.AiGatewayMcpServerConversionListenerConfigUpstreamAuthAwsArgs
{
AccessKeyId = "...my_access_key_id...",
AssumeRoleArn = "...my_assume_role_arn...",
Region = "...my_region...",
RoleSessionName = "...my_role_session_name...",
SecretAccessKey = "...my_secret_access_key...",
SessionToken = "...my_session_token...",
StsEndpointUrl = "...my_sts_endpoint_url...",
},
},
},
Url = "https://mcp.internal.kongair.com",
},
Datastores = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerDatastoreArgs
{
Name = "shared-redis",
},
},
DisplayName = "Kong Air Flights",
Enabled = true,
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "kongair-flights",
Policies = new[]
{
"...",
},
RateLimiting = new Konnect.Inputs.AiGatewayMcpServerConversionListenerRateLimitingArgs
{
Limits = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerRateLimitingLimitArgs
{
Limit = 100,
Method = "tools/call",
Tool = "search_flights",
WindowSize = 60,
},
},
},
TokenVault = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultArgs
{
Cache = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheArgs
{
Redis = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationArgs
{
Aws = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs
{
AccessKeyId = "...my_access_key_id...",
AssumeRoleArn = "...my_assume_role_arn...",
CacheName = "...my_cache_name...",
IsServerless = true,
Region = "...my_region...",
RoleSessionName = "...my_role_session_name...",
SecretAccessKey = "...my_secret_access_key...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisKeepaliveArgs
{
Backlog = 2020486820,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "master",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
},
Credential = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCredentialArgs
{
Inbound = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCredentialInboundArgs
{
Location = "header",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
Outbound = new Konnect.Inputs.AiGatewayMcpServerConversionListenerTokenVaultCredentialOutboundArgs
{
Location = "query",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
},
Provider = "...my_provider...",
SubjectTokenType = "access_token",
},
Tools = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerToolArgs
{
Access = new Konnect.Inputs.AiGatewayMcpServerConversionListenerToolAccessArgs
{
Acls = new Konnect.Inputs.AiGatewayMcpServerConversionListenerToolAccessAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
},
Annotations = new Konnect.Inputs.AiGatewayMcpServerConversionListenerToolAnnotationsArgs
{
DestructiveHint = true,
IdempotentHint = false,
OpenWorldHint = false,
ReadOnlyHint = true,
Title = "...my_title...",
},
Description = "Search for available flights",
Headers = "{ \"see\": \"documentation\" }",
Host = "...my_host...",
Method = "POST",
Name = "...my_name...",
Parameters = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionListenerToolParameterArgs
{
Description = "The origin airport code.",
In = "query",
Name = "origin",
Required = true,
Schema =
{
{ "key", JsonSerializer.Serialize("value") },
},
},
},
Path = "...my_path...",
Query = "{ \"see\": \"documentation\" }",
RequestBody = "{ \"see\": \"documentation\" }",
Responses = "{ \"see\": \"documentation\" }",
Scheme = "https",
},
},
},
ConversionOnly = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyArgs
{
Config = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyConfigArgs
{
CaCertificates = new[]
{
"my-ca-certificate",
},
Certificates = new[]
{
"my-certificate",
},
Logging = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyConfigLoggingArgs
{
Audits = false,
Payloads = false,
},
MaxRequestBodySize = 8388608,
Route = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyConfigRouteArgs
{
Headers =
{
{ "key", JsonSerializer.Serialize("value") },
},
Hosts = new[]
{
"foo.example.com",
},
HttpsRedirectStatusCode = 426,
Methods = new[]
{
"...",
},
Paths = new[]
{
"...",
},
PreserveHost = false,
Protocols = new[]
{
"...",
},
RegexPriority = 0,
RequestBuffering = true,
ResponseBuffering = true,
StripPath = true,
Tags = new[]
{
"...",
},
},
Upstream = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyConfigUpstreamArgs
{
Auth = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyConfigUpstreamAuthArgs
{
Aws = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyConfigUpstreamAuthAwsArgs
{
AccessKeyId = "...my_access_key_id...",
AssumeRoleArn = "...my_assume_role_arn...",
Region = "...my_region...",
RoleSessionName = "...my_role_session_name...",
SecretAccessKey = "...my_secret_access_key...",
SessionToken = "...my_session_token...",
StsEndpointUrl = "...my_sts_endpoint_url...",
},
},
},
Url = "https://mcp.internal.kongair.com",
},
Datastores = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionOnlyDatastoreArgs
{
Name = "shared-redis",
},
},
DisplayName = "Kong Air Flights",
Enabled = true,
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "kongair-flights",
Policies = new[]
{
"...",
},
TokenVault = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultArgs
{
Cache = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheArgs
{
Redis = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationArgs
{
Gcp = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationGcpArgs
{
ServiceAccountJson = "...my_service_account_json...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisKeepaliveArgs
{
Backlog = 1023472511,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "slave",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
},
Credential = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCredentialArgs
{
Inbound = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCredentialInboundArgs
{
Location = "query",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
Outbound = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyTokenVaultCredentialOutboundArgs
{
Location = "body",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
},
Provider = "...my_provider...",
SubjectTokenType = "access_token",
},
Tools = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionOnlyToolArgs
{
Access = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyToolAccessArgs
{
Acls = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyToolAccessAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
},
Annotations = new Konnect.Inputs.AiGatewayMcpServerConversionOnlyToolAnnotationsArgs
{
DestructiveHint = false,
IdempotentHint = true,
OpenWorldHint = true,
ReadOnlyHint = false,
Title = "...my_title...",
},
Description = "Search for available flights",
Headers = "{ \"see\": \"documentation\" }",
Host = "...my_host...",
Method = "PATCH",
Name = "...my_name...",
Parameters = new[]
{
new Konnect.Inputs.AiGatewayMcpServerConversionOnlyToolParameterArgs
{
Description = "The origin airport code.",
In = "query",
Name = "origin",
Required = true,
Schema =
{
{ "key", JsonSerializer.Serialize("value") },
},
},
},
Path = "...my_path...",
Query = "{ \"see\": \"documentation\" }",
RequestBody = "{ \"see\": \"documentation\" }",
Responses = "{ \"see\": \"documentation\" }",
Scheme = "http",
},
},
},
GatewayId = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
Listener = new Konnect.Inputs.AiGatewayMcpServerListenerArgs
{
Access = new Konnect.Inputs.AiGatewayMcpServerListenerAccessArgs
{
OauthAccessToken = new Konnect.Inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenArgs
{
AccessTokenClaimField = "...my_access_token_claim_field...",
Acls = new Konnect.Inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
AuthStrategies = new[]
{
"okta-ai-se",
},
DefaultToolAcls = new Konnect.Inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenDefaultToolAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
IdentityProviders = new[]
{
"okta-ai-se",
},
Metadata = new Konnect.Inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenMetadataArgs
{
AuthorizationServers = new[]
{
"...",
},
DiscoveryEndpoint = "...my_discovery_endpoint...",
Endpoint = "...my_endpoint...",
Resource = "...my_resource...",
ScopesSupporteds = new[]
{
"...",
},
},
},
},
Config = new Konnect.Inputs.AiGatewayMcpServerListenerConfigArgs
{
AllowedVersions = new[]
{
"2025-11-25",
},
Cache = new Konnect.Inputs.AiGatewayMcpServerListenerConfigCacheArgs
{
Discover = new Konnect.Inputs.AiGatewayMcpServerListenerConfigCacheDiscoverArgs
{
CacheScope = "private",
TtlMs = 8,
},
ToolsList = new Konnect.Inputs.AiGatewayMcpServerListenerConfigCacheToolsListArgs
{
CacheScope = "private",
TtlMs = 6,
},
},
Logging = new Konnect.Inputs.AiGatewayMcpServerListenerConfigLoggingArgs
{
Audits = false,
Payloads = false,
},
MaxRequestBodySize = 8388608,
Route = new Konnect.Inputs.AiGatewayMcpServerListenerConfigRouteArgs
{
Headers =
{
{ "key", JsonSerializer.Serialize("value") },
},
Hosts = new[]
{
"foo.example.com",
},
HttpsRedirectStatusCode = 426,
Methods = new[]
{
"...",
},
Paths = new[]
{
"...",
},
PreserveHost = false,
Protocols = new[]
{
"...",
},
RegexPriority = 0,
RequestBuffering = true,
ResponseBuffering = true,
StripPath = true,
Tags = new[]
{
"...",
},
},
Server = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerArgs
{
ForwardClientHeaders = true,
Session = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionArgs
{
Client = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionClientArgs
{
Secrets = new[]
{
"...",
},
},
Managed = true,
Redis = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationArgs
{
Gcp = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationGcpArgs
{
ServiceAccountJson = "...my_service_account_json...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisKeepaliveArgs
{
Backlog = 254844406,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerListenerConfigServerSessionRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "master",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
SessionTtl = 86400,
Strategy = "redis",
},
Timeout = 10000,
},
},
Datastores = new[]
{
new Konnect.Inputs.AiGatewayMcpServerListenerDatastoreArgs
{
Name = "shared-redis",
},
},
DisplayName = "Kong Air Flights",
Enabled = true,
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "kongair-flights",
Policies = new[]
{
"...",
},
Sources = new[]
{
"kongair-flights",
"github-mcp",
},
TokenVault = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultArgs
{
Cache = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheArgs
{
Redis = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationArgs
{
Aws = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs
{
AccessKeyId = "...my_access_key_id...",
AssumeRoleArn = "...my_assume_role_arn...",
CacheName = "...my_cache_name...",
IsServerless = true,
Region = "...my_region...",
RoleSessionName = "...my_role_session_name...",
SecretAccessKey = "...my_secret_access_key...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisKeepaliveArgs
{
Backlog = 1304566812,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "master",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
},
Credential = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCredentialArgs
{
Inbound = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCredentialInboundArgs
{
Location = "header",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
Outbound = new Konnect.Inputs.AiGatewayMcpServerListenerTokenVaultCredentialOutboundArgs
{
Location = "query",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
},
Provider = "...my_provider...",
SubjectTokenType = "api_key",
},
},
PassthroughListener = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerArgs
{
Access = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerAccessArgs
{
Consumer = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerArgs
{
Acls = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
AuthStrategies = new[]
{
"okta-ai-se",
},
DefaultToolAcls = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerDefaultToolAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
IdentityProviders = new[]
{
"okta-ai-se",
},
Metadata = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerMetadataArgs
{
AuthorizationServers = new[]
{
"...",
},
DiscoveryEndpoint = "...my_discovery_endpoint...",
Endpoint = "...my_endpoint...",
Resource = "...my_resource...",
ScopesSupporteds = new[]
{
"...",
},
},
},
},
Config = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigArgs
{
CaCertificates = new[]
{
"my-ca-certificate",
},
Certificates = new[]
{
"my-certificate",
},
Logging = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigLoggingArgs
{
Audits = false,
Payloads = false,
},
MaxRequestBodySize = 8388608,
Proxy = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigProxyArgs
{
Auth = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigProxyAuthArgs
{
Password = "...my_password...",
Username = "...my_username...",
},
HttpProxy = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigProxyHttpProxyArgs
{
Host = "...my_host...",
Port = 43233,
},
HttpsProxy = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigProxyHttpsProxyArgs
{
Host = "...my_host...",
Port = 31216,
},
NoProxy = "...my_no_proxy...",
ProxyScheme = "http",
},
Route = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigRouteArgs
{
Headers =
{
{ "key", JsonSerializer.Serialize("value") },
},
Hosts = new[]
{
"foo.example.com",
},
HttpsRedirectStatusCode = 426,
Methods = new[]
{
"...",
},
Paths = new[]
{
"...",
},
PreserveHost = false,
Protocols = new[]
{
"...",
},
RegexPriority = 0,
RequestBuffering = true,
ResponseBuffering = true,
StripPath = true,
Tags = new[]
{
"...",
},
},
Server = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerArgs
{
ForwardClientHeaders = true,
Session = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionArgs
{
Client = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionClientArgs
{
Secrets = new[]
{
"...",
},
},
Managed = true,
Redis = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationArgs
{
Azure = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAzureArgs
{
ClientId = "...my_client_id...",
ClientSecret = "...my_client_secret...",
TenantId = "...my_tenant_id...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisKeepaliveArgs
{
Backlog = 1750673053,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "any",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
SessionTtl = 86400,
Strategy = "redis",
},
Timeout = 10000,
},
Upstream = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigUpstreamArgs
{
Auth = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthArgs
{
Aws = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthAwsArgs
{
AccessKeyId = "...my_access_key_id...",
AssumeRoleArn = "...my_assume_role_arn...",
Region = "...my_region...",
RoleSessionName = "...my_role_session_name...",
SecretAccessKey = "...my_secret_access_key...",
SessionToken = "...my_session_token...",
StsEndpointUrl = "...my_sts_endpoint_url...",
},
},
},
Url = "https://mcp.internal.kongair.com",
},
Datastores = new[]
{
new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerDatastoreArgs
{
Name = "shared-redis",
},
},
DisplayName = "Kong Air Flights",
Enabled = true,
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "kongair-flights",
Policies = new[]
{
"...",
},
RateLimiting = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerRateLimitingArgs
{
Limits = new[]
{
new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerRateLimitingLimitArgs
{
Limit = 100,
Method = "tools/call",
Tool = "search_flights",
WindowSize = 60,
},
},
},
TokenVault = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultArgs
{
Cache = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheArgs
{
Redis = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationArgs
{
Gcp = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationGcpArgs
{
ServiceAccountJson = "...my_service_account_json...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisKeepaliveArgs
{
Backlog = 1262712627,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "any",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
},
Credential = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialArgs
{
Inbound = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialInboundArgs
{
Location = "query",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
Outbound = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialOutboundArgs
{
Location = "header",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
},
Provider = "...my_provider...",
SubjectTokenType = "api_key",
},
Tools = new[]
{
new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerToolArgs
{
Access = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerToolAccessArgs
{
Acls = new Konnect.Inputs.AiGatewayMcpServerPassthroughListenerToolAccessAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
},
Name = "...my_name...",
},
},
},
UpstreamServer = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerArgs
{
Config = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigArgs
{
CaCertificates = new[]
{
"my-ca-certificate",
},
Certificates = new[]
{
"my-certificate",
},
Logging = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigLoggingArgs
{
Audits = false,
Payloads = false,
},
MaxRequestBodySize = 8388608,
Route = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigRouteArgs
{
Headers =
{
{ "key", JsonSerializer.Serialize("value") },
},
Hosts = new[]
{
"foo.example.com",
},
HttpsRedirectStatusCode = 426,
Methods = new[]
{
"...",
},
Paths = new[]
{
"...",
},
PreserveHost = false,
Protocols = new[]
{
"...",
},
RegexPriority = 0,
RequestBuffering = true,
ResponseBuffering = true,
StripPath = true,
Tags = new[]
{
"...",
},
},
Server = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerArgs
{
ForwardClientHeaders = true,
PreserveUpstreamToolNames = false,
Session = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionArgs
{
Client = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionClientArgs
{
Secrets = new[]
{
"...",
},
},
Managed = true,
Redis = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationArgs
{
Gcp = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationGcpArgs
{
ServiceAccountJson = "...my_service_account_json...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisKeepaliveArgs
{
Backlog = 176733398,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "master",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
SessionTtl = 86400,
Strategy = "redis",
},
Timeout = 10000,
ToolsListAuth = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthArgs
{
Jwt = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthJwtArgs
{
AccessTokenHeader = "Authorization",
IdTokenHeader = "...my_id_token_header...",
Scope = "...my_scope...",
},
},
UpstreamProtocolVersion = "2025-06-18",
},
ToolsCacheTtlSeconds = 7,
Upstream = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigUpstreamArgs
{
Auth = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigUpstreamAuthArgs
{
Aws = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerConfigUpstreamAuthAwsArgs
{
AccessKeyId = "...my_access_key_id...",
AssumeRoleArn = "...my_assume_role_arn...",
Region = "...my_region...",
RoleSessionName = "...my_role_session_name...",
SecretAccessKey = "...my_secret_access_key...",
SessionToken = "...my_session_token...",
StsEndpointUrl = "...my_sts_endpoint_url...",
},
},
},
Url = "https://mcp.internal.kongair.com",
},
Datastores = new[]
{
new Konnect.Inputs.AiGatewayMcpServerUpstreamServerDatastoreArgs
{
Name = "shared-redis",
},
},
DisplayName = "Kong Air Flights",
Enabled = true,
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "kongair-flights",
Policies = new[]
{
"...",
},
TokenVault = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultArgs
{
Cache = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheArgs
{
Redis = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationArgs
{
Gcp = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationGcpArgs
{
ServiceAccountJson = "...my_service_account_json...",
},
},
Cluster = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterArgs
{
MaxRedirections = 5,
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
Keepalive = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisKeepaliveArgs
{
Backlog = 1008848731,
PoolSize = 256,
},
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
Sentinel = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelArgs
{
Master = "...my_master...",
Nodes = new[]
{
new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
Password = "...my_password...",
Role = "any",
Username = "...my_username...",
},
ServerName = "...my_server_name...",
Ssl = true,
SslVerify = true,
Username = "...my_username...",
},
},
Credential = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCredentialArgs
{
Inbound = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCredentialInboundArgs
{
Location = "body",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
Outbound = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerTokenVaultCredentialOutboundArgs
{
Location = "header",
Name = "...my_name...",
Prefix = "...my_prefix...",
},
},
Provider = "...my_provider...",
SubjectTokenType = "api_key",
},
Tools = new[]
{
new Konnect.Inputs.AiGatewayMcpServerUpstreamServerToolArgs
{
Access = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerToolAccessArgs
{
Acls = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerToolAccessAclsArgs
{
Allows = new[]
{
"...",
},
AllowWhens = new[]
{
"...",
},
Denies = new[]
{
"...",
},
DenyWhens = new[]
{
"...",
},
},
},
Annotations = new Konnect.Inputs.AiGatewayMcpServerUpstreamServerToolAnnotationsArgs
{
DestructiveHint = true,
IdempotentHint = true,
OpenWorldHint = false,
ReadOnlyHint = true,
Title = "...my_title...",
},
Description = "Search for available flights",
InputSchema = "{ \"see\": \"documentation\" }",
Name = "...my_name...",
OutputSchema = "{ \"see\": \"documentation\" }",
},
},
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.konnect.AiGatewayMcpServer;
import com.pulumi.konnect.AiGatewayMcpServerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerAccessArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenAclsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenDefaultToolAclsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerAccessOauthAccessTokenMetadataArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigCacheDiscoverArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigCacheToolsListArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigLoggingArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigRouteArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionClientArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAzureArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigUpstreamArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigUpstreamAuthArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerConfigUpstreamAuthAwsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerRateLimitingArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCredentialArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCredentialInboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionListenerTokenVaultCredentialOutboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyConfigLoggingArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyConfigRouteArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyConfigUpstreamArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyConfigUpstreamAuthArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyConfigUpstreamAuthAwsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationGcpArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCredentialArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCredentialInboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerConversionOnlyTokenVaultCredentialOutboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerAccessArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenAclsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenDefaultToolAclsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerAccessOauthAccessTokenMetadataArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigCacheDiscoverArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigCacheToolsListArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigLoggingArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigRouteArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionClientArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationGcpArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerConfigServerSessionRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCredentialArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCredentialInboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerListenerTokenVaultCredentialOutboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerAccessArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerAclsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerDefaultToolAclsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerAccessConsumerMetadataArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigLoggingArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigProxyArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigProxyAuthArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigProxyHttpProxyArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigProxyHttpsProxyArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigRouteArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionClientArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAzureArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigUpstreamArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthAwsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerRateLimitingArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationGcpArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialInboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerPassthroughListenerTokenVaultCredentialOutboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigLoggingArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigRouteArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionClientArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationGcpArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthJwtArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigUpstreamArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigUpstreamAuthArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerConfigUpstreamAuthAwsArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationGcpArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisKeepaliveArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCredentialArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCredentialInboundArgs;
import com.pulumi.konnect.inputs.AiGatewayMcpServerUpstreamServerTokenVaultCredentialOutboundArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var myAigatewaymcpserver = new AiGatewayMcpServer("myAigatewaymcpserver", AiGatewayMcpServerArgs.builder()
.conversionListener(AiGatewayMcpServerConversionListenerArgs.builder()
.access(AiGatewayMcpServerConversionListenerAccessArgs.builder()
.oauthAccessToken(AiGatewayMcpServerConversionListenerAccessOauthAccessTokenArgs.builder()
.accessTokenClaimField("...my_access_token_claim_field...")
.acls(AiGatewayMcpServerConversionListenerAccessOauthAccessTokenAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.authStrategies("okta-ai-se")
.defaultToolAcls(AiGatewayMcpServerConversionListenerAccessOauthAccessTokenDefaultToolAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.identityProviders("okta-ai-se")
.metadata(AiGatewayMcpServerConversionListenerAccessOauthAccessTokenMetadataArgs.builder()
.authorizationServers("...")
.discoveryEndpoint("...my_discovery_endpoint...")
.endpoint("...my_endpoint...")
.resource("...my_resource...")
.scopesSupporteds("...")
.build())
.build())
.build())
.config(AiGatewayMcpServerConversionListenerConfigArgs.builder()
.allowedVersions("2025-06-18")
.caCertificates("my-ca-certificate")
.cache(AiGatewayMcpServerConversionListenerConfigCacheArgs.builder()
.discover(AiGatewayMcpServerConversionListenerConfigCacheDiscoverArgs.builder()
.cacheScope("private")
.ttlMs(5.0)
.build())
.toolsList(AiGatewayMcpServerConversionListenerConfigCacheToolsListArgs.builder()
.cacheScope("private")
.ttlMs(1.0)
.build())
.build())
.certificates("my-certificate")
.logging(AiGatewayMcpServerConversionListenerConfigLoggingArgs.builder()
.audits(false)
.payloads(false)
.build())
.maxRequestBodySize(8388608.0)
.route(AiGatewayMcpServerConversionListenerConfigRouteArgs.builder()
.headers(Map.of("key", serializeJson(
"value")))
.hosts("foo.example.com")
.httpsRedirectStatusCode(426.0)
.methods("...")
.paths("...")
.preserveHost(false)
.protocols("...")
.regexPriority(0.0)
.requestBuffering(true)
.responseBuffering(true)
.stripPath(true)
.tags("...")
.build())
.server(AiGatewayMcpServerConversionListenerConfigServerArgs.builder()
.forwardClientHeaders(true)
.session(AiGatewayMcpServerConversionListenerConfigServerSessionArgs.builder()
.client(AiGatewayMcpServerConversionListenerConfigServerSessionClientArgs.builder()
.secrets("...")
.build())
.managed(true)
.redis(AiGatewayMcpServerConversionListenerConfigServerSessionRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationArgs.builder()
.azure(AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAzureArgs.builder()
.clientId("...my_client_id...")
.clientSecret("...my_client_secret...")
.tenantId("...my_tenant_id...")
.build())
.build())
.cluster(AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerConversionListenerConfigServerSessionRedisKeepaliveArgs.builder()
.backlog(1275755412.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("slave")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.sessionTtl(86400.0)
.strategy("redis")
.build())
.timeout(10000.0)
.build())
.upstream(AiGatewayMcpServerConversionListenerConfigUpstreamArgs.builder()
.auth(AiGatewayMcpServerConversionListenerConfigUpstreamAuthArgs.builder()
.aws(AiGatewayMcpServerConversionListenerConfigUpstreamAuthAwsArgs.builder()
.accessKeyId("...my_access_key_id...")
.assumeRoleArn("...my_assume_role_arn...")
.region("...my_region...")
.roleSessionName("...my_role_session_name...")
.secretAccessKey("...my_secret_access_key...")
.sessionToken("...my_session_token...")
.stsEndpointUrl("...my_sts_endpoint_url...")
.build())
.build())
.build())
.url("https://mcp.internal.kongair.com")
.build())
.datastores(AiGatewayMcpServerConversionListenerDatastoreArgs.builder()
.name("shared-redis")
.build())
.displayName("Kong Air Flights")
.enabled(true)
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("kongair-flights")
.policies("...")
.rateLimiting(AiGatewayMcpServerConversionListenerRateLimitingArgs.builder()
.limits(AiGatewayMcpServerConversionListenerRateLimitingLimitArgs.builder()
.limit(100.0)
.method("tools/call")
.tool("search_flights")
.windowSize(60.0)
.build())
.build())
.tokenVault(AiGatewayMcpServerConversionListenerTokenVaultArgs.builder()
.cache(AiGatewayMcpServerConversionListenerTokenVaultCacheArgs.builder()
.redis(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationArgs.builder()
.aws(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs.builder()
.accessKeyId("...my_access_key_id...")
.assumeRoleArn("...my_assume_role_arn...")
.cacheName("...my_cache_name...")
.isServerless(true)
.region("...my_region...")
.roleSessionName("...my_role_session_name...")
.secretAccessKey("...my_secret_access_key...")
.build())
.build())
.cluster(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisKeepaliveArgs.builder()
.backlog(2020486820.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("master")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.build())
.credential(AiGatewayMcpServerConversionListenerTokenVaultCredentialArgs.builder()
.inbound(AiGatewayMcpServerConversionListenerTokenVaultCredentialInboundArgs.builder()
.location("header")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.outbound(AiGatewayMcpServerConversionListenerTokenVaultCredentialOutboundArgs.builder()
.location("query")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.build())
.provider("...my_provider...")
.subjectTokenType("access_token")
.build())
.tools(AiGatewayMcpServerConversionListenerToolArgs.builder()
.access(AiGatewayMcpServerConversionListenerToolAccessArgs.builder()
.acls(AiGatewayMcpServerConversionListenerToolAccessAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.build())
.annotations(AiGatewayMcpServerConversionListenerToolAnnotationsArgs.builder()
.destructiveHint(true)
.idempotentHint(false)
.openWorldHint(false)
.readOnlyHint(true)
.title("...my_title...")
.build())
.description("Search for available flights")
.headers("{ \"see\": \"documentation\" }")
.host("...my_host...")
.method("POST")
.name("...my_name...")
.parameters(AiGatewayMcpServerConversionListenerToolParameterArgs.builder()
.description("The origin airport code.")
.in("query")
.name("origin")
.required(true)
.schema(Map.of("key", serializeJson(
"value")))
.build())
.path("...my_path...")
.query("{ \"see\": \"documentation\" }")
.requestBody("{ \"see\": \"documentation\" }")
.responses("{ \"see\": \"documentation\" }")
.scheme("https")
.build())
.build())
.conversionOnly(AiGatewayMcpServerConversionOnlyArgs.builder()
.config(AiGatewayMcpServerConversionOnlyConfigArgs.builder()
.caCertificates("my-ca-certificate")
.certificates("my-certificate")
.logging(AiGatewayMcpServerConversionOnlyConfigLoggingArgs.builder()
.audits(false)
.payloads(false)
.build())
.maxRequestBodySize(8388608.0)
.route(AiGatewayMcpServerConversionOnlyConfigRouteArgs.builder()
.headers(Map.of("key", serializeJson(
"value")))
.hosts("foo.example.com")
.httpsRedirectStatusCode(426.0)
.methods("...")
.paths("...")
.preserveHost(false)
.protocols("...")
.regexPriority(0.0)
.requestBuffering(true)
.responseBuffering(true)
.stripPath(true)
.tags("...")
.build())
.upstream(AiGatewayMcpServerConversionOnlyConfigUpstreamArgs.builder()
.auth(AiGatewayMcpServerConversionOnlyConfigUpstreamAuthArgs.builder()
.aws(AiGatewayMcpServerConversionOnlyConfigUpstreamAuthAwsArgs.builder()
.accessKeyId("...my_access_key_id...")
.assumeRoleArn("...my_assume_role_arn...")
.region("...my_region...")
.roleSessionName("...my_role_session_name...")
.secretAccessKey("...my_secret_access_key...")
.sessionToken("...my_session_token...")
.stsEndpointUrl("...my_sts_endpoint_url...")
.build())
.build())
.build())
.url("https://mcp.internal.kongair.com")
.build())
.datastores(AiGatewayMcpServerConversionOnlyDatastoreArgs.builder()
.name("shared-redis")
.build())
.displayName("Kong Air Flights")
.enabled(true)
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("kongair-flights")
.policies("...")
.tokenVault(AiGatewayMcpServerConversionOnlyTokenVaultArgs.builder()
.cache(AiGatewayMcpServerConversionOnlyTokenVaultCacheArgs.builder()
.redis(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationArgs.builder()
.gcp(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationGcpArgs.builder()
.serviceAccountJson("...my_service_account_json...")
.build())
.build())
.cluster(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisKeepaliveArgs.builder()
.backlog(1023472511.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("slave")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.build())
.credential(AiGatewayMcpServerConversionOnlyTokenVaultCredentialArgs.builder()
.inbound(AiGatewayMcpServerConversionOnlyTokenVaultCredentialInboundArgs.builder()
.location("query")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.outbound(AiGatewayMcpServerConversionOnlyTokenVaultCredentialOutboundArgs.builder()
.location("body")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.build())
.provider("...my_provider...")
.subjectTokenType("access_token")
.build())
.tools(AiGatewayMcpServerConversionOnlyToolArgs.builder()
.access(AiGatewayMcpServerConversionOnlyToolAccessArgs.builder()
.acls(AiGatewayMcpServerConversionOnlyToolAccessAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.build())
.annotations(AiGatewayMcpServerConversionOnlyToolAnnotationsArgs.builder()
.destructiveHint(false)
.idempotentHint(true)
.openWorldHint(true)
.readOnlyHint(false)
.title("...my_title...")
.build())
.description("Search for available flights")
.headers("{ \"see\": \"documentation\" }")
.host("...my_host...")
.method("PATCH")
.name("...my_name...")
.parameters(AiGatewayMcpServerConversionOnlyToolParameterArgs.builder()
.description("The origin airport code.")
.in("query")
.name("origin")
.required(true)
.schema(Map.of("key", serializeJson(
"value")))
.build())
.path("...my_path...")
.query("{ \"see\": \"documentation\" }")
.requestBody("{ \"see\": \"documentation\" }")
.responses("{ \"see\": \"documentation\" }")
.scheme("http")
.build())
.build())
.gatewayId("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7")
.listener(AiGatewayMcpServerListenerArgs.builder()
.access(AiGatewayMcpServerListenerAccessArgs.builder()
.oauthAccessToken(AiGatewayMcpServerListenerAccessOauthAccessTokenArgs.builder()
.accessTokenClaimField("...my_access_token_claim_field...")
.acls(AiGatewayMcpServerListenerAccessOauthAccessTokenAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.authStrategies("okta-ai-se")
.defaultToolAcls(AiGatewayMcpServerListenerAccessOauthAccessTokenDefaultToolAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.identityProviders("okta-ai-se")
.metadata(AiGatewayMcpServerListenerAccessOauthAccessTokenMetadataArgs.builder()
.authorizationServers("...")
.discoveryEndpoint("...my_discovery_endpoint...")
.endpoint("...my_endpoint...")
.resource("...my_resource...")
.scopesSupporteds("...")
.build())
.build())
.build())
.config(AiGatewayMcpServerListenerConfigArgs.builder()
.allowedVersions("2025-11-25")
.cache(AiGatewayMcpServerListenerConfigCacheArgs.builder()
.discover(AiGatewayMcpServerListenerConfigCacheDiscoverArgs.builder()
.cacheScope("private")
.ttlMs(8.0)
.build())
.toolsList(AiGatewayMcpServerListenerConfigCacheToolsListArgs.builder()
.cacheScope("private")
.ttlMs(6.0)
.build())
.build())
.logging(AiGatewayMcpServerListenerConfigLoggingArgs.builder()
.audits(false)
.payloads(false)
.build())
.maxRequestBodySize(8388608.0)
.route(AiGatewayMcpServerListenerConfigRouteArgs.builder()
.headers(Map.of("key", serializeJson(
"value")))
.hosts("foo.example.com")
.httpsRedirectStatusCode(426.0)
.methods("...")
.paths("...")
.preserveHost(false)
.protocols("...")
.regexPriority(0.0)
.requestBuffering(true)
.responseBuffering(true)
.stripPath(true)
.tags("...")
.build())
.server(AiGatewayMcpServerListenerConfigServerArgs.builder()
.forwardClientHeaders(true)
.session(AiGatewayMcpServerListenerConfigServerSessionArgs.builder()
.client(AiGatewayMcpServerListenerConfigServerSessionClientArgs.builder()
.secrets("...")
.build())
.managed(true)
.redis(AiGatewayMcpServerListenerConfigServerSessionRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationArgs.builder()
.gcp(AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationGcpArgs.builder()
.serviceAccountJson("...my_service_account_json...")
.build())
.build())
.cluster(AiGatewayMcpServerListenerConfigServerSessionRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerListenerConfigServerSessionRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerListenerConfigServerSessionRedisKeepaliveArgs.builder()
.backlog(254844406.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerListenerConfigServerSessionRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerListenerConfigServerSessionRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("master")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.sessionTtl(86400.0)
.strategy("redis")
.build())
.timeout(10000.0)
.build())
.build())
.datastores(AiGatewayMcpServerListenerDatastoreArgs.builder()
.name("shared-redis")
.build())
.displayName("Kong Air Flights")
.enabled(true)
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("kongair-flights")
.policies("...")
.sources(
"kongair-flights",
"github-mcp")
.tokenVault(AiGatewayMcpServerListenerTokenVaultArgs.builder()
.cache(AiGatewayMcpServerListenerTokenVaultCacheArgs.builder()
.redis(AiGatewayMcpServerListenerTokenVaultCacheRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationArgs.builder()
.aws(AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs.builder()
.accessKeyId("...my_access_key_id...")
.assumeRoleArn("...my_assume_role_arn...")
.cacheName("...my_cache_name...")
.isServerless(true)
.region("...my_region...")
.roleSessionName("...my_role_session_name...")
.secretAccessKey("...my_secret_access_key...")
.build())
.build())
.cluster(AiGatewayMcpServerListenerTokenVaultCacheRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerListenerTokenVaultCacheRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerListenerTokenVaultCacheRedisKeepaliveArgs.builder()
.backlog(1304566812.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("master")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.build())
.credential(AiGatewayMcpServerListenerTokenVaultCredentialArgs.builder()
.inbound(AiGatewayMcpServerListenerTokenVaultCredentialInboundArgs.builder()
.location("header")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.outbound(AiGatewayMcpServerListenerTokenVaultCredentialOutboundArgs.builder()
.location("query")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.build())
.provider("...my_provider...")
.subjectTokenType("api_key")
.build())
.build())
.passthroughListener(AiGatewayMcpServerPassthroughListenerArgs.builder()
.access(AiGatewayMcpServerPassthroughListenerAccessArgs.builder()
.consumer(AiGatewayMcpServerPassthroughListenerAccessConsumerArgs.builder()
.acls(AiGatewayMcpServerPassthroughListenerAccessConsumerAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.authStrategies("okta-ai-se")
.defaultToolAcls(AiGatewayMcpServerPassthroughListenerAccessConsumerDefaultToolAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.identityProviders("okta-ai-se")
.metadata(AiGatewayMcpServerPassthroughListenerAccessConsumerMetadataArgs.builder()
.authorizationServers("...")
.discoveryEndpoint("...my_discovery_endpoint...")
.endpoint("...my_endpoint...")
.resource("...my_resource...")
.scopesSupporteds("...")
.build())
.build())
.build())
.config(AiGatewayMcpServerPassthroughListenerConfigArgs.builder()
.caCertificates("my-ca-certificate")
.certificates("my-certificate")
.logging(AiGatewayMcpServerPassthroughListenerConfigLoggingArgs.builder()
.audits(false)
.payloads(false)
.build())
.maxRequestBodySize(8388608.0)
.proxy(AiGatewayMcpServerPassthroughListenerConfigProxyArgs.builder()
.auth(AiGatewayMcpServerPassthroughListenerConfigProxyAuthArgs.builder()
.password("...my_password...")
.username("...my_username...")
.build())
.httpProxy(AiGatewayMcpServerPassthroughListenerConfigProxyHttpProxyArgs.builder()
.host("...my_host...")
.port(43233.0)
.build())
.httpsProxy(AiGatewayMcpServerPassthroughListenerConfigProxyHttpsProxyArgs.builder()
.host("...my_host...")
.port(31216.0)
.build())
.noProxy("...my_no_proxy...")
.proxyScheme("http")
.build())
.route(AiGatewayMcpServerPassthroughListenerConfigRouteArgs.builder()
.headers(Map.of("key", serializeJson(
"value")))
.hosts("foo.example.com")
.httpsRedirectStatusCode(426.0)
.methods("...")
.paths("...")
.preserveHost(false)
.protocols("...")
.regexPriority(0.0)
.requestBuffering(true)
.responseBuffering(true)
.stripPath(true)
.tags("...")
.build())
.server(AiGatewayMcpServerPassthroughListenerConfigServerArgs.builder()
.forwardClientHeaders(true)
.session(AiGatewayMcpServerPassthroughListenerConfigServerSessionArgs.builder()
.client(AiGatewayMcpServerPassthroughListenerConfigServerSessionClientArgs.builder()
.secrets("...")
.build())
.managed(true)
.redis(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationArgs.builder()
.azure(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAzureArgs.builder()
.clientId("...my_client_id...")
.clientSecret("...my_client_secret...")
.tenantId("...my_tenant_id...")
.build())
.build())
.cluster(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisKeepaliveArgs.builder()
.backlog(1750673053.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("any")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.sessionTtl(86400.0)
.strategy("redis")
.build())
.timeout(10000.0)
.build())
.upstream(AiGatewayMcpServerPassthroughListenerConfigUpstreamArgs.builder()
.auth(AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthArgs.builder()
.aws(AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthAwsArgs.builder()
.accessKeyId("...my_access_key_id...")
.assumeRoleArn("...my_assume_role_arn...")
.region("...my_region...")
.roleSessionName("...my_role_session_name...")
.secretAccessKey("...my_secret_access_key...")
.sessionToken("...my_session_token...")
.stsEndpointUrl("...my_sts_endpoint_url...")
.build())
.build())
.build())
.url("https://mcp.internal.kongair.com")
.build())
.datastores(AiGatewayMcpServerPassthroughListenerDatastoreArgs.builder()
.name("shared-redis")
.build())
.displayName("Kong Air Flights")
.enabled(true)
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("kongair-flights")
.policies("...")
.rateLimiting(AiGatewayMcpServerPassthroughListenerRateLimitingArgs.builder()
.limits(AiGatewayMcpServerPassthroughListenerRateLimitingLimitArgs.builder()
.limit(100.0)
.method("tools/call")
.tool("search_flights")
.windowSize(60.0)
.build())
.build())
.tokenVault(AiGatewayMcpServerPassthroughListenerTokenVaultArgs.builder()
.cache(AiGatewayMcpServerPassthroughListenerTokenVaultCacheArgs.builder()
.redis(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationArgs.builder()
.gcp(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationGcpArgs.builder()
.serviceAccountJson("...my_service_account_json...")
.build())
.build())
.cluster(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisKeepaliveArgs.builder()
.backlog(1262712627.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("any")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.build())
.credential(AiGatewayMcpServerPassthroughListenerTokenVaultCredentialArgs.builder()
.inbound(AiGatewayMcpServerPassthroughListenerTokenVaultCredentialInboundArgs.builder()
.location("query")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.outbound(AiGatewayMcpServerPassthroughListenerTokenVaultCredentialOutboundArgs.builder()
.location("header")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.build())
.provider("...my_provider...")
.subjectTokenType("api_key")
.build())
.tools(AiGatewayMcpServerPassthroughListenerToolArgs.builder()
.access(AiGatewayMcpServerPassthroughListenerToolAccessArgs.builder()
.acls(AiGatewayMcpServerPassthroughListenerToolAccessAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.build())
.name("...my_name...")
.build())
.build())
.upstreamServer(AiGatewayMcpServerUpstreamServerArgs.builder()
.config(AiGatewayMcpServerUpstreamServerConfigArgs.builder()
.caCertificates("my-ca-certificate")
.certificates("my-certificate")
.logging(AiGatewayMcpServerUpstreamServerConfigLoggingArgs.builder()
.audits(false)
.payloads(false)
.build())
.maxRequestBodySize(8388608.0)
.route(AiGatewayMcpServerUpstreamServerConfigRouteArgs.builder()
.headers(Map.of("key", serializeJson(
"value")))
.hosts("foo.example.com")
.httpsRedirectStatusCode(426.0)
.methods("...")
.paths("...")
.preserveHost(false)
.protocols("...")
.regexPriority(0.0)
.requestBuffering(true)
.responseBuffering(true)
.stripPath(true)
.tags("...")
.build())
.server(AiGatewayMcpServerUpstreamServerConfigServerArgs.builder()
.forwardClientHeaders(true)
.preserveUpstreamToolNames(false)
.session(AiGatewayMcpServerUpstreamServerConfigServerSessionArgs.builder()
.client(AiGatewayMcpServerUpstreamServerConfigServerSessionClientArgs.builder()
.secrets("...")
.build())
.managed(true)
.redis(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationArgs.builder()
.gcp(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationGcpArgs.builder()
.serviceAccountJson("...my_service_account_json...")
.build())
.build())
.cluster(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisKeepaliveArgs.builder()
.backlog(176733398.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("master")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.sessionTtl(86400.0)
.strategy("redis")
.build())
.timeout(10000.0)
.toolsListAuth(AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthArgs.builder()
.jwt(AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthJwtArgs.builder()
.accessTokenHeader("Authorization")
.idTokenHeader("...my_id_token_header...")
.scope("...my_scope...")
.build())
.build())
.upstreamProtocolVersion("2025-06-18")
.build())
.toolsCacheTtlSeconds(7.0)
.upstream(AiGatewayMcpServerUpstreamServerConfigUpstreamArgs.builder()
.auth(AiGatewayMcpServerUpstreamServerConfigUpstreamAuthArgs.builder()
.aws(AiGatewayMcpServerUpstreamServerConfigUpstreamAuthAwsArgs.builder()
.accessKeyId("...my_access_key_id...")
.assumeRoleArn("...my_assume_role_arn...")
.region("...my_region...")
.roleSessionName("...my_role_session_name...")
.secretAccessKey("...my_secret_access_key...")
.sessionToken("...my_session_token...")
.stsEndpointUrl("...my_sts_endpoint_url...")
.build())
.build())
.build())
.url("https://mcp.internal.kongair.com")
.build())
.datastores(AiGatewayMcpServerUpstreamServerDatastoreArgs.builder()
.name("shared-redis")
.build())
.displayName("Kong Air Flights")
.enabled(true)
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("kongair-flights")
.policies("...")
.tokenVault(AiGatewayMcpServerUpstreamServerTokenVaultArgs.builder()
.cache(AiGatewayMcpServerUpstreamServerTokenVaultCacheArgs.builder()
.redis(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisArgs.builder()
.cloudAuthentication(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationArgs.builder()
.gcp(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationGcpArgs.builder()
.serviceAccountJson("...my_service_account_json...")
.build())
.build())
.cluster(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterArgs.builder()
.maxRedirections(5.0)
.nodes(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepalive(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisKeepaliveArgs.builder()
.backlog(1008848731.0)
.poolSize(256.0)
.build())
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinel(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelArgs.builder()
.master("...my_master...")
.nodes(AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.password("...my_password...")
.role("any")
.username("...my_username...")
.build())
.serverName("...my_server_name...")
.ssl(true)
.sslVerify(true)
.username("...my_username...")
.build())
.build())
.credential(AiGatewayMcpServerUpstreamServerTokenVaultCredentialArgs.builder()
.inbound(AiGatewayMcpServerUpstreamServerTokenVaultCredentialInboundArgs.builder()
.location("body")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.outbound(AiGatewayMcpServerUpstreamServerTokenVaultCredentialOutboundArgs.builder()
.location("header")
.name("...my_name...")
.prefix("...my_prefix...")
.build())
.build())
.provider("...my_provider...")
.subjectTokenType("api_key")
.build())
.tools(AiGatewayMcpServerUpstreamServerToolArgs.builder()
.access(AiGatewayMcpServerUpstreamServerToolAccessArgs.builder()
.acls(AiGatewayMcpServerUpstreamServerToolAccessAclsArgs.builder()
.allows("...")
.allowWhens("...")
.denies("...")
.denyWhens("...")
.build())
.build())
.annotations(AiGatewayMcpServerUpstreamServerToolAnnotationsArgs.builder()
.destructiveHint(true)
.idempotentHint(true)
.openWorldHint(false)
.readOnlyHint(true)
.title("...my_title...")
.build())
.description("Search for available flights")
.inputSchema("{ \"see\": \"documentation\" }")
.name("...my_name...")
.outputSchema("{ \"see\": \"documentation\" }")
.build())
.build())
.build());
}
}
resources:
myAigatewaymcpserver:
type: konnect:AiGatewayMcpServer
name: my_aigatewaymcpserver
properties:
conversionListener:
access:
oauthAccessToken:
accessTokenClaimField: '...my_access_token_claim_field...'
acls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
authStrategies:
- okta-ai-se
defaultToolAcls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
identityProviders:
- okta-ai-se
metadata:
authorizationServers:
- '...'
discoveryEndpoint: '...my_discovery_endpoint...'
endpoint: '...my_endpoint...'
resource: '...my_resource...'
scopesSupporteds:
- '...'
config:
allowedVersions:
- 2025-06-18
caCertificates:
- my-ca-certificate
cache:
discover:
cacheScope: private
ttlMs: 5
toolsList:
cacheScope: private
ttlMs: 1
certificates:
- my-certificate
logging:
audits: false
payloads: false
maxRequestBodySize: 8.388608e+06
route:
headers:
key:
fn::toJSON: value
hosts:
- foo.example.com
httpsRedirectStatusCode: 426
methods:
- '...'
paths:
- '...'
preserveHost: false
protocols:
- '...'
regexPriority: 0
requestBuffering: true
responseBuffering: true
stripPath: true
tags:
- '...'
server:
forwardClientHeaders: true
session:
client:
secrets:
- '...'
managed: true
redis:
cloudAuthentication:
azure:
clientId: '...my_client_id...'
clientSecret: '...my_client_secret...'
tenantId: '...my_tenant_id...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 1.275755412e+09
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: slave
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
sessionTtl: 86400
strategy: redis
timeout: 10000
upstream:
auth:
aws:
accessKeyId: '...my_access_key_id...'
assumeRoleArn: '...my_assume_role_arn...'
region: '...my_region...'
roleSessionName: '...my_role_session_name...'
secretAccessKey: '...my_secret_access_key...'
sessionToken: '...my_session_token...'
stsEndpointUrl: '...my_sts_endpoint_url...'
url: https://mcp.internal.kongair.com
datastores:
- name: shared-redis
displayName: Kong Air Flights
enabled: true
labels:
key: value
managedBy:
key: value
name: kongair-flights
policies:
- '...'
rateLimiting:
limits:
- limit: 100
method: tools/call
tool: search_flights
windowSize: 60
tokenVault:
cache:
redis:
cloudAuthentication:
aws:
accessKeyId: '...my_access_key_id...'
assumeRoleArn: '...my_assume_role_arn...'
cacheName: '...my_cache_name...'
isServerless: true
region: '...my_region...'
roleSessionName: '...my_role_session_name...'
secretAccessKey: '...my_secret_access_key...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 2.02048682e+09
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: master
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
credential:
inbound:
location: header
name: '...my_name...'
prefix: '...my_prefix...'
outbound:
location: query
name: '...my_name...'
prefix: '...my_prefix...'
provider: '...my_provider...'
subjectTokenType: access_token
tools:
- access:
acls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
annotations:
destructiveHint: true
idempotentHint: false
openWorldHint: false
readOnlyHint: true
title: '...my_title...'
description: Search for available flights
headers: '{ "see": "documentation" }'
host: '...my_host...'
method: POST
name: '...my_name...'
parameters:
- description: The origin airport code.
in: query
name: origin
required: true
schema:
key:
fn::toJSON: value
path: '...my_path...'
query: '{ "see": "documentation" }'
requestBody: '{ "see": "documentation" }'
responses: '{ "see": "documentation" }'
scheme: https
conversionOnly:
config:
caCertificates:
- my-ca-certificate
certificates:
- my-certificate
logging:
audits: false
payloads: false
maxRequestBodySize: 8.388608e+06
route:
headers:
key:
fn::toJSON: value
hosts:
- foo.example.com
httpsRedirectStatusCode: 426
methods:
- '...'
paths:
- '...'
preserveHost: false
protocols:
- '...'
regexPriority: 0
requestBuffering: true
responseBuffering: true
stripPath: true
tags:
- '...'
upstream:
auth:
aws:
accessKeyId: '...my_access_key_id...'
assumeRoleArn: '...my_assume_role_arn...'
region: '...my_region...'
roleSessionName: '...my_role_session_name...'
secretAccessKey: '...my_secret_access_key...'
sessionToken: '...my_session_token...'
stsEndpointUrl: '...my_sts_endpoint_url...'
url: https://mcp.internal.kongair.com
datastores:
- name: shared-redis
displayName: Kong Air Flights
enabled: true
labels:
key: value
managedBy:
key: value
name: kongair-flights
policies:
- '...'
tokenVault:
cache:
redis:
cloudAuthentication:
gcp:
serviceAccountJson: '...my_service_account_json...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 1.023472511e+09
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: slave
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
credential:
inbound:
location: query
name: '...my_name...'
prefix: '...my_prefix...'
outbound:
location: body
name: '...my_name...'
prefix: '...my_prefix...'
provider: '...my_provider...'
subjectTokenType: access_token
tools:
- access:
acls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
annotations:
destructiveHint: false
idempotentHint: true
openWorldHint: true
readOnlyHint: false
title: '...my_title...'
description: Search for available flights
headers: '{ "see": "documentation" }'
host: '...my_host...'
method: PATCH
name: '...my_name...'
parameters:
- description: The origin airport code.
in: query
name: origin
required: true
schema:
key:
fn::toJSON: value
path: '...my_path...'
query: '{ "see": "documentation" }'
requestBody: '{ "see": "documentation" }'
responses: '{ "see": "documentation" }'
scheme: http
gatewayId: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
listener:
access:
oauthAccessToken:
accessTokenClaimField: '...my_access_token_claim_field...'
acls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
authStrategies:
- okta-ai-se
defaultToolAcls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
identityProviders:
- okta-ai-se
metadata:
authorizationServers:
- '...'
discoveryEndpoint: '...my_discovery_endpoint...'
endpoint: '...my_endpoint...'
resource: '...my_resource...'
scopesSupporteds:
- '...'
config:
allowedVersions:
- 2025-11-25
cache:
discover:
cacheScope: private
ttlMs: 8
toolsList:
cacheScope: private
ttlMs: 6
logging:
audits: false
payloads: false
maxRequestBodySize: 8.388608e+06
route:
headers:
key:
fn::toJSON: value
hosts:
- foo.example.com
httpsRedirectStatusCode: 426
methods:
- '...'
paths:
- '...'
preserveHost: false
protocols:
- '...'
regexPriority: 0
requestBuffering: true
responseBuffering: true
stripPath: true
tags:
- '...'
server:
forwardClientHeaders: true
session:
client:
secrets:
- '...'
managed: true
redis:
cloudAuthentication:
gcp:
serviceAccountJson: '...my_service_account_json...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 2.54844406e+08
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: master
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
sessionTtl: 86400
strategy: redis
timeout: 10000
datastores:
- name: shared-redis
displayName: Kong Air Flights
enabled: true
labels:
key: value
managedBy:
key: value
name: kongair-flights
policies:
- '...'
sources:
- kongair-flights
- github-mcp
tokenVault:
cache:
redis:
cloudAuthentication:
aws:
accessKeyId: '...my_access_key_id...'
assumeRoleArn: '...my_assume_role_arn...'
cacheName: '...my_cache_name...'
isServerless: true
region: '...my_region...'
roleSessionName: '...my_role_session_name...'
secretAccessKey: '...my_secret_access_key...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 1.304566812e+09
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: master
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
credential:
inbound:
location: header
name: '...my_name...'
prefix: '...my_prefix...'
outbound:
location: query
name: '...my_name...'
prefix: '...my_prefix...'
provider: '...my_provider...'
subjectTokenType: api_key
passthroughListener:
access:
consumer:
acls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
authStrategies:
- okta-ai-se
defaultToolAcls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
identityProviders:
- okta-ai-se
metadata:
authorizationServers:
- '...'
discoveryEndpoint: '...my_discovery_endpoint...'
endpoint: '...my_endpoint...'
resource: '...my_resource...'
scopesSupporteds:
- '...'
config:
caCertificates:
- my-ca-certificate
certificates:
- my-certificate
logging:
audits: false
payloads: false
maxRequestBodySize: 8.388608e+06
proxy:
auth:
password: '...my_password...'
username: '...my_username...'
httpProxy:
host: '...my_host...'
port: 43233
httpsProxy:
host: '...my_host...'
port: 31216
noProxy: '...my_no_proxy...'
proxyScheme: http
route:
headers:
key:
fn::toJSON: value
hosts:
- foo.example.com
httpsRedirectStatusCode: 426
methods:
- '...'
paths:
- '...'
preserveHost: false
protocols:
- '...'
regexPriority: 0
requestBuffering: true
responseBuffering: true
stripPath: true
tags:
- '...'
server:
forwardClientHeaders: true
session:
client:
secrets:
- '...'
managed: true
redis:
cloudAuthentication:
azure:
clientId: '...my_client_id...'
clientSecret: '...my_client_secret...'
tenantId: '...my_tenant_id...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 1.750673053e+09
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: any
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
sessionTtl: 86400
strategy: redis
timeout: 10000
upstream:
auth:
aws:
accessKeyId: '...my_access_key_id...'
assumeRoleArn: '...my_assume_role_arn...'
region: '...my_region...'
roleSessionName: '...my_role_session_name...'
secretAccessKey: '...my_secret_access_key...'
sessionToken: '...my_session_token...'
stsEndpointUrl: '...my_sts_endpoint_url...'
url: https://mcp.internal.kongair.com
datastores:
- name: shared-redis
displayName: Kong Air Flights
enabled: true
labels:
key: value
managedBy:
key: value
name: kongair-flights
policies:
- '...'
rateLimiting:
limits:
- limit: 100
method: tools/call
tool: search_flights
windowSize: 60
tokenVault:
cache:
redis:
cloudAuthentication:
gcp:
serviceAccountJson: '...my_service_account_json...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 1.262712627e+09
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: any
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
credential:
inbound:
location: query
name: '...my_name...'
prefix: '...my_prefix...'
outbound:
location: header
name: '...my_name...'
prefix: '...my_prefix...'
provider: '...my_provider...'
subjectTokenType: api_key
tools:
- access:
acls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
name: '...my_name...'
upstreamServer:
config:
caCertificates:
- my-ca-certificate
certificates:
- my-certificate
logging:
audits: false
payloads: false
maxRequestBodySize: 8.388608e+06
route:
headers:
key:
fn::toJSON: value
hosts:
- foo.example.com
httpsRedirectStatusCode: 426
methods:
- '...'
paths:
- '...'
preserveHost: false
protocols:
- '...'
regexPriority: 0
requestBuffering: true
responseBuffering: true
stripPath: true
tags:
- '...'
server:
forwardClientHeaders: true
preserveUpstreamToolNames: false
session:
client:
secrets:
- '...'
managed: true
redis:
cloudAuthentication:
gcp:
serviceAccountJson: '...my_service_account_json...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 1.76733398e+08
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: master
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
sessionTtl: 86400
strategy: redis
timeout: 10000
toolsListAuth:
jwt:
accessTokenHeader: Authorization
idTokenHeader: '...my_id_token_header...'
scope: '...my_scope...'
upstreamProtocolVersion: 2025-06-18
toolsCacheTtlSeconds: 7
upstream:
auth:
aws:
accessKeyId: '...my_access_key_id...'
assumeRoleArn: '...my_assume_role_arn...'
region: '...my_region...'
roleSessionName: '...my_role_session_name...'
secretAccessKey: '...my_secret_access_key...'
sessionToken: '...my_session_token...'
stsEndpointUrl: '...my_sts_endpoint_url...'
url: https://mcp.internal.kongair.com
datastores:
- name: shared-redis
displayName: Kong Air Flights
enabled: true
labels:
key: value
managedBy:
key: value
name: kongair-flights
policies:
- '...'
tokenVault:
cache:
redis:
cloudAuthentication:
gcp:
serviceAccountJson: '...my_service_account_json...'
cluster:
maxRedirections: 5
nodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepalive:
backlog: 1.008848731e+09
poolSize: 256
password: '...my_password...'
port: 6379
readTimeout: 2000
sendTimeout: 2000
sentinel:
master: '...my_master...'
nodes:
- host: 127.0.0.1
port: 6379
password: '...my_password...'
role: any
username: '...my_username...'
serverName: '...my_server_name...'
ssl: true
sslVerify: true
username: '...my_username...'
credential:
inbound:
location: body
name: '...my_name...'
prefix: '...my_prefix...'
outbound:
location: header
name: '...my_name...'
prefix: '...my_prefix...'
provider: '...my_provider...'
subjectTokenType: api_key
tools:
- access:
acls:
allows:
- '...'
allowWhens:
- '...'
denies:
- '...'
denyWhens:
- '...'
annotations:
destructiveHint: true
idempotentHint: true
openWorldHint: false
readOnlyHint: true
title: '...my_title...'
description: Search for available flights
inputSchema: '{ "see": "documentation" }'
name: '...my_name...'
outputSchema: '{ "see": "documentation" }'
Example coming soon!
Create AiGatewayMcpServer Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new AiGatewayMcpServer(name: string, args: AiGatewayMcpServerArgs, opts?: CustomResourceOptions);@overload
def AiGatewayMcpServer(resource_name: str,
args: AiGatewayMcpServerArgs,
opts: Optional[ResourceOptions] = None)
@overload
def AiGatewayMcpServer(resource_name: str,
opts: Optional[ResourceOptions] = None,
gateway_id: Optional[str] = None,
conversion_listener: Optional[AiGatewayMcpServerConversionListenerArgs] = None,
conversion_only: Optional[AiGatewayMcpServerConversionOnlyArgs] = None,
listener: Optional[AiGatewayMcpServerListenerArgs] = None,
passthrough_listener: Optional[AiGatewayMcpServerPassthroughListenerArgs] = None,
upstream_server: Optional[AiGatewayMcpServerUpstreamServerArgs] = None)func NewAiGatewayMcpServer(ctx *Context, name string, args AiGatewayMcpServerArgs, opts ...ResourceOption) (*AiGatewayMcpServer, error)public AiGatewayMcpServer(string name, AiGatewayMcpServerArgs args, CustomResourceOptions? opts = null)
public AiGatewayMcpServer(String name, AiGatewayMcpServerArgs args)
public AiGatewayMcpServer(String name, AiGatewayMcpServerArgs args, CustomResourceOptions options)
type: konnect:AiGatewayMcpServer
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "konnect_ai_gateway_mcp_server" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args AiGatewayMcpServerArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args AiGatewayMcpServerArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args AiGatewayMcpServerArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AiGatewayMcpServerArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args AiGatewayMcpServerArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
AiGatewayMcpServer Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The AiGatewayMcpServer resource accepts the following input properties:
- Gateway
Id string - The unique ID of the AI Gateway.
- Conversion
Listener AiGateway Mcp Server Conversion Listener Args - Conversion
Only AiGateway Mcp Server Conversion Only Args - Listener
Ai
Gateway Mcp Server Listener Args - Passthrough
Listener AiGateway Mcp Server Passthrough Listener Args - Upstream
Server AiGateway Mcp Server Upstream Server Args
- gateway_
id string - The unique ID of the AI Gateway.
- conversion_
listener object - conversion_
only object - listener object
- passthrough_
listener object - upstream_
server object
- gateway_
id str - The unique ID of the AI Gateway.
- conversion_
listener AiGateway Mcp Server Conversion Listener Args - conversion_
only AiGateway Mcp Server Conversion Only Args - listener
Ai
Gateway Mcp Server Listener Args - passthrough_
listener AiGateway Mcp Server Passthrough Listener Args - upstream_
server AiGateway Mcp Server Upstream Server Args
- gateway
Id String - The unique ID of the AI Gateway.
- conversion
Listener Property Map - conversion
Only Property Map - listener Property Map
- passthrough
Listener Property Map - upstream
Server Property Map
Outputs
All input properties are implicitly available as output properties. Additionally, the AiGatewayMcpServer resource produces the following output properties:
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- The provider-assigned unique ID for this managed resource.
- Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- The provider-assigned unique ID for this managed resource.
- Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- display_
name string - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id string
- The provider-assigned unique ID for this managed resource.
- name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- The provider-assigned unique ID for this managed resource.
- name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- display
Name string - The display name for the MCP Server.
- enabled boolean
- Whether the MCP Server is enabled.
- id string
- The provider-assigned unique ID for this managed resource.
- name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- display_
name str - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id str
- The provider-assigned unique ID for this managed resource.
- name str
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- The provider-assigned unique ID for this managed resource.
- name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
Look up Existing AiGatewayMcpServer Resource
Get an existing AiGatewayMcpServer resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AiGatewayMcpServerState, opts?: CustomResourceOptions): AiGatewayMcpServer@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
conversion_listener: Optional[AiGatewayMcpServerConversionListenerArgs] = None,
conversion_only: Optional[AiGatewayMcpServerConversionOnlyArgs] = None,
created_at: Optional[str] = None,
display_name: Optional[str] = None,
enabled: Optional[bool] = None,
gateway_id: Optional[str] = None,
listener: Optional[AiGatewayMcpServerListenerArgs] = None,
name: Optional[str] = None,
passthrough_listener: Optional[AiGatewayMcpServerPassthroughListenerArgs] = None,
updated_at: Optional[str] = None,
upstream_server: Optional[AiGatewayMcpServerUpstreamServerArgs] = None) -> AiGatewayMcpServerfunc GetAiGatewayMcpServer(ctx *Context, name string, id IDInput, state *AiGatewayMcpServerState, opts ...ResourceOption) (*AiGatewayMcpServer, error)public static AiGatewayMcpServer Get(string name, Input<string> id, AiGatewayMcpServerState? state, CustomResourceOptions? opts = null)public static AiGatewayMcpServer get(String name, Output<String> id, AiGatewayMcpServerState state, CustomResourceOptions options)resources: _: type: konnect:AiGatewayMcpServer get: id: ${id}import {
to = konnect_ai_gateway_mcp_server.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Conversion
Listener AiGateway Mcp Server Conversion Listener - Conversion
Only AiGateway Mcp Server Conversion Only - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Gateway
Id string - The unique ID of the AI Gateway.
- Listener
Ai
Gateway Mcp Server Listener - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Passthrough
Listener AiGateway Mcp Server Passthrough Listener - Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Upstream
Server AiGateway Mcp Server Upstream Server
- Conversion
Listener AiGateway Mcp Server Conversion Listener Args - Conversion
Only AiGateway Mcp Server Conversion Only Args - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Gateway
Id string - The unique ID of the AI Gateway.
- Listener
Ai
Gateway Mcp Server Listener Args - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Passthrough
Listener AiGateway Mcp Server Passthrough Listener Args - Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Upstream
Server AiGateway Mcp Server Upstream Server Args
- conversion_
listener object - conversion_
only object - created_
at string - An ISO-8601 timestamp representation of entity creation date.
- display_
name string - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- gateway_
id string - The unique ID of the AI Gateway.
- listener object
- name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- passthrough_
listener object - updated_
at string - An ISO-8601 timestamp representation of entity update date.
- upstream_
server object
- conversion
Listener AiGateway Mcp Server Conversion Listener - conversion
Only AiGateway Mcp Server Conversion Only - created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- gateway
Id String - The unique ID of the AI Gateway.
- listener
Ai
Gateway Mcp Server Listener - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- passthrough
Listener AiGateway Mcp Server Passthrough Listener - updated
At String - An ISO-8601 timestamp representation of entity update date.
- upstream
Server AiGateway Mcp Server Upstream Server
- conversion
Listener AiGateway Mcp Server Conversion Listener - conversion
Only AiGateway Mcp Server Conversion Only - created
At string - An ISO-8601 timestamp representation of entity creation date.
- display
Name string - The display name for the MCP Server.
- enabled boolean
- Whether the MCP Server is enabled.
- gateway
Id string - The unique ID of the AI Gateway.
- listener
Ai
Gateway Mcp Server Listener - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- passthrough
Listener AiGateway Mcp Server Passthrough Listener - updated
At string - An ISO-8601 timestamp representation of entity update date.
- upstream
Server AiGateway Mcp Server Upstream Server
- conversion_
listener AiGateway Mcp Server Conversion Listener Args - conversion_
only AiGateway Mcp Server Conversion Only Args - created_
at str - An ISO-8601 timestamp representation of entity creation date.
- display_
name str - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- gateway_
id str - The unique ID of the AI Gateway.
- listener
Ai
Gateway Mcp Server Listener Args - name str
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- passthrough_
listener AiGateway Mcp Server Passthrough Listener Args - updated_
at str - An ISO-8601 timestamp representation of entity update date.
- upstream_
server AiGateway Mcp Server Upstream Server Args
- conversion
Listener Property Map - conversion
Only Property Map - created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- gateway
Id String - The unique ID of the AI Gateway.
- listener Property Map
- name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- passthrough
Listener Property Map - updated
At String - An ISO-8601 timestamp representation of entity update date.
- upstream
Server Property Map
Supporting Types
AiGatewayMcpServerConversionListener, AiGatewayMcpServerConversionListenerArgs
- Access
Ai
Gateway Mcp Server Conversion Listener Access - Config
Ai
Gateway Mcp Server Conversion Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
List<Ai
Gateway Mcp Server Conversion Listener Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies List<string>
- List of policy references.
- Rate
Limiting AiGateway Mcp Server Conversion Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- Token
Vault AiGateway Mcp Server Conversion Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
List<Ai
Gateway Mcp Server Conversion Listener Tool> - List of tools exposed by this MCP Server. Each tool's
path,method, andhostdescribe the backend HTTP operation on the upstream selected byconfig.url— they do not need to match the public MCP Route configured inconfig.route. Not Null - Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Access
Ai
Gateway Mcp Server Conversion Listener Access - Config
Ai
Gateway Mcp Server Conversion Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
[]Ai
Gateway Mcp Server Conversion Listener Datastore - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies []string
- List of policy references.
- Rate
Limiting AiGateway Mcp Server Conversion Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- Token
Vault AiGateway Mcp Server Conversion Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
[]Ai
Gateway Mcp Server Conversion Listener Tool - List of tools exposed by this MCP Server. Each tool's
path,method, andhostdescribe the backend HTTP operation on the upstream selected byconfig.url— they do not need to match the public MCP Route configured inconfig.route. Not Null - Updated
At string - An ISO-8601 timestamp representation of entity update date.
- access object
- config object
- Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- datastores list(object)
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name string - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by map(string) - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies list(string)
- List of policy references.
- rate_
limiting object Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token_
vault object Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools list(object)
- List of tools exposed by this MCP Server. Each tool's
path,method, andhostdescribe the backend HTTP operation on the upstream selected byconfig.url— they do not need to match the public MCP Route configured inconfig.route. Not Null - updated_
at string - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Conversion Listener Access - config
Ai
Gateway Mcp Server Conversion Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores
List<Ai
Gateway Mcp Server Conversion Listener Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- rate
Limiting AiGateway Mcp Server Conversion Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token
Vault AiGateway Mcp Server Conversion Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
List<Ai
Gateway Mcp Server Conversion Listener Tool> - List of tools exposed by this MCP Server. Each tool's
path,method, andhostdescribe the backend HTTP operation on the upstream selected byconfig.url— they do not need to match the public MCP Route configured inconfig.route. Not Null - updated
At String - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Conversion Listener Access - config
Ai
Gateway Mcp Server Conversion Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- datastores
Ai
Gateway Mcp Server Conversion Listener Datastore[] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name string - The display name for the MCP Server.
- enabled boolean
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies string[]
- List of policy references.
- rate
Limiting AiGateway Mcp Server Conversion Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token
Vault AiGateway Mcp Server Conversion Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Ai
Gateway Mcp Server Conversion Listener Tool[] - List of tools exposed by this MCP Server. Each tool's
path,method, andhostdescribe the backend HTTP operation on the upstream selected byconfig.url— they do not need to match the public MCP Route configured inconfig.route. Not Null - updated
At string - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Conversion Listener Access - config
Ai
Gateway Mcp Server Conversion Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- datastores
Sequence[Ai
Gateway Mcp Server Conversion Listener Datastore] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name str - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies Sequence[str]
- List of policy references.
- rate_
limiting AiGateway Mcp Server Conversion Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token_
vault AiGateway Mcp Server Conversion Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Sequence[Ai
Gateway Mcp Server Conversion Listener Tool] - List of tools exposed by this MCP Server. Each tool's
path,method, andhostdescribe the backend HTTP operation on the upstream selected byconfig.url— they do not need to match the public MCP Route configured inconfig.route. Not Null - updated_
at str - An ISO-8601 timestamp representation of entity update date.
- access Property Map
- config Property Map
- Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores List<Property Map>
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- rate
Limiting Property Map Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token
Vault Property Map Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools List<Property Map>
- List of tools exposed by this MCP Server. Each tool's
path,method, andhostdescribe the backend HTTP operation on the upstream selected byconfig.url— they do not need to match the public MCP Route configured inconfig.route. Not Null - updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayMcpServerConversionListenerAccess, AiGatewayMcpServerConversionListenerAccessArgs
- Consumer
Ai
Gateway Mcp Server Conversion Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Oauth
Access AiToken Gateway Mcp Server Conversion Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Consumer
Ai
Gateway Mcp Server Conversion Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Oauth
Access AiToken Gateway Mcp Server Conversion Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer object
- Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth_
access_ objecttoken - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Conversion Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access AiToken Gateway Mcp Server Conversion Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Conversion Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access AiToken Gateway Mcp Server Conversion Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Conversion Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth_
access_ Aitoken Gateway Mcp Server Conversion Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer Property Map
- Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access Property MapToken - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
AiGatewayMcpServerConversionListenerAccessConsumer, AiGatewayMcpServerConversionListenerAccessConsumerArgs
- Acls
Ai
Gateway Mcp Server Conversion Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies List<string> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers List<string> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Conversion Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- Acls
Ai
Gateway Mcp Server Conversion Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies []string - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers []string - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Conversion Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls object
- Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies list(string) - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ objectacls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers list(string) - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata object
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Conversion Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Conversion Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Conversion Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies string[] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers string[] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Conversion Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Conversion Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies Sequence[str] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ Aiacls Gateway Mcp Server Conversion Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers Sequence[str] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Conversion Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls Property Map
- Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool Property MapAcls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata Property Map
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
AiGatewayMcpServerConversionListenerAccessConsumerAcls, AiGatewayMcpServerConversionListenerAccessConsumerAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
AiGatewayMcpServerConversionListenerAccessConsumerDefaultToolAcls, AiGatewayMcpServerConversionListenerAccessConsumerDefaultToolAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerConversionListenerAccessConsumerMetadata, AiGatewayMcpServerConversionListenerAccessConsumerMetadataArgs
- List<string>
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds List<string> - List of OAuth scopes supported by the protected resource.
- []string
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds []string - List of OAuth scopes supported by the protected resource.
- list(string)
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes_
supporteds list(string) - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
- string[]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes
Supporteds string[] - List of OAuth scopes supported by the protected resource.
- Sequence[str]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint str - The authorization server metadata discovery URL.
- endpoint str
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource str
- The protected resource's identifier (resource URI).
- scopes_
supporteds Sequence[str] - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
AiGatewayMcpServerConversionListenerAccessOauthAccessToken, AiGatewayMcpServerConversionListenerAccessOauthAccessTokenArgs
- Access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - Acls
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies List<string> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers List<string> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- Access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - Acls
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies []string - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers []string - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access_
token_ stringclaim_ field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls object
- Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies list(string) - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ objectacls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers list(string) - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata object
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token StringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies string[] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Conversion Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers string[] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access_
token_ strclaim_ field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies Sequence[str] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ Aiacls Gateway Mcp Server Conversion Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers Sequence[str] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Conversion Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token StringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls Property Map
- Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool Property MapAcls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata Property Map
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
AiGatewayMcpServerConversionListenerAccessOauthAccessTokenAcls, AiGatewayMcpServerConversionListenerAccessOauthAccessTokenAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
AiGatewayMcpServerConversionListenerAccessOauthAccessTokenDefaultToolAcls, AiGatewayMcpServerConversionListenerAccessOauthAccessTokenDefaultToolAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerConversionListenerAccessOauthAccessTokenMetadata, AiGatewayMcpServerConversionListenerAccessOauthAccessTokenMetadataArgs
- List<string>
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds List<string> - List of OAuth scopes supported by the protected resource.
- []string
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds []string - List of OAuth scopes supported by the protected resource.
- list(string)
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes_
supporteds list(string) - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
- string[]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes
Supporteds string[] - List of OAuth scopes supported by the protected resource.
- Sequence[str]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint str - The authorization server metadata discovery URL.
- endpoint str
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource str
- The protected resource's identifier (resource URI).
- scopes_
supporteds Sequence[str] - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
AiGatewayMcpServerConversionListenerConfig, AiGatewayMcpServerConversionListenerConfigArgs
- Allowed
Versions List<string> - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - Ca
Certificates List<string> CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway.The CA certificates build the trust store (
ca_certificates) of the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server.If unset, the default trust store is used to verify the upstream's TLS certificate.
- Cache
Ai
Gateway Mcp Server Conversion Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- Certificates List<string>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Conversion Listener Config Logging - Configuration for AI Gateway logging.
- Max
Request doubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Conversion Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Conversion Listener Config Server - Server-side configuration for the MCP Server.
- Upstream
Ai
Gateway Mcp Server Conversion Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- Allowed
Versions []string - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - Ca
Certificates []string CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway.The CA certificates build the trust store (
ca_certificates) of the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server.If unset, the default trust store is used to verify the upstream's TLS certificate.
- Cache
Ai
Gateway Mcp Server Conversion Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- Certificates []string
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Conversion Listener Config Logging - Configuration for AI Gateway logging.
- Max
Request float64Body Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Conversion Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Conversion Listener Config Server - Server-side configuration for the MCP Server.
- Upstream
Ai
Gateway Mcp Server Conversion Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- allowed_
versions list(string) - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - ca_
certificates list(string) CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway.The CA certificates build the trust store (
ca_certificates) of the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server.If unset, the default trust store is used to verify the upstream's TLS certificate.
- cache object
Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- certificates list(string)
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging object
- Configuration for AI Gateway logging.
- max_
request_ numberbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route object
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server object
- Server-side configuration for the MCP Server.
- upstream object
- Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- allowed
Versions List<String> - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - ca
Certificates List<String> CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway.The CA certificates build the trust store (
ca_certificates) of the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server.If unset, the default trust store is used to verify the upstream's TLS certificate.
- cache
Ai
Gateway Mcp Server Conversion Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Conversion Listener Config Logging - Configuration for AI Gateway logging.
- max
Request DoubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Conversion Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Conversion Listener Config Server - Server-side configuration for the MCP Server.
- upstream
Ai
Gateway Mcp Server Conversion Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- allowed
Versions string[] - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - ca
Certificates string[] CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway.The CA certificates build the trust store (
ca_certificates) of the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server.If unset, the default trust store is used to verify the upstream's TLS certificate.
- cache
Ai
Gateway Mcp Server Conversion Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- certificates string[]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Conversion Listener Config Logging - Configuration for AI Gateway logging.
- max
Request numberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Conversion Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Conversion Listener Config Server - Server-side configuration for the MCP Server.
- upstream
Ai
Gateway Mcp Server Conversion Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- allowed_
versions Sequence[str] - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - ca_
certificates Sequence[str] CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway.The CA certificates build the trust store (
ca_certificates) of the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server.If unset, the default trust store is used to verify the upstream's TLS certificate.
- cache
Ai
Gateway Mcp Server Conversion Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- certificates Sequence[str]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Conversion Listener Config Logging - Configuration for AI Gateway logging.
- max_
request_ floatbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Conversion Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Conversion Listener Config Server - Server-side configuration for the MCP Server.
- upstream
Ai
Gateway Mcp Server Conversion Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url str
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- allowed
Versions List<String> - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - ca
Certificates List<String> CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway.The CA certificates build the trust store (
ca_certificates) of the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server.If unset, the default trust store is used to verify the upstream's TLS certificate.
- cache Property Map
Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging Property Map
- Configuration for AI Gateway logging.
- max
Request NumberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route Property Map
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server Property Map
- Server-side configuration for the MCP Server.
- upstream Property Map
- Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
AiGatewayMcpServerConversionListenerConfigCache, AiGatewayMcpServerConversionListenerConfigCacheArgs
- Discover
Ai
Gateway Mcp Server Conversion Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- Tools
List AiGateway Mcp Server Conversion Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- Discover
Ai
Gateway Mcp Server Conversion Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- Tools
List AiGateway Mcp Server Conversion Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover object
- A cache hint Kong emits on a cacheable operation it serves.
- tools_
list object - A cache hint Kong emits on a cacheable operation it serves.
- discover
Ai
Gateway Mcp Server Conversion Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- tools
List AiGateway Mcp Server Conversion Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover
Ai
Gateway Mcp Server Conversion Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- tools
List AiGateway Mcp Server Conversion Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover
Ai
Gateway Mcp Server Conversion Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- tools_
list AiGateway Mcp Server Conversion Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover Property Map
- A cache hint Kong emits on a cacheable operation it serves.
- tools
List Property Map - A cache hint Kong emits on a cacheable operation it serves.
AiGatewayMcpServerConversionListenerConfigCacheDiscover, AiGatewayMcpServerConversionListenerConfigCacheDiscoverArgs
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms double - How long a client may treat the result as fresh, in milliseconds.
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms float64 - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms number - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Double - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms number - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope str - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms float - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Number - How long a client may treat the result as fresh, in milliseconds.
AiGatewayMcpServerConversionListenerConfigCacheToolsList, AiGatewayMcpServerConversionListenerConfigCacheToolsListArgs
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms double - How long a client may treat the result as fresh, in milliseconds.
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms float64 - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms number - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Double - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms number - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope str - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms float - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Number - How long a client may treat the result as fresh, in milliseconds.
AiGatewayMcpServerConversionListenerConfigLogging, AiGatewayMcpServerConversionListenerConfigLoggingArgs
AiGatewayMcpServerConversionListenerConfigRoute, AiGatewayMcpServerConversionListenerConfigRouteArgs
- Headers Dictionary<string, string>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts List<string>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect doubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods List<string>
- A list of HTTP methods that match this route.
- Paths List<string>
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols List<string>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<string>
- An optional set of strings associated with the route for grouping and filtering.
- Headers map[string]string
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts []string
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect float64Status Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods []string
- A list of HTTP methods that match this route.
- Paths []string
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols []string
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority float64 - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - []string
- An optional set of strings associated with the route for grouping and filtering.
- headers map(string)
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts list(string)
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ numberstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods list(string)
- A list of HTTP methods that match this route.
- paths list(string)
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols list(string)
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - list(string)
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String,String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect DoubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
- headers {[key: string]: string}
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts string[]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect numberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods string[]
- A list of HTTP methods that match this route.
- paths string[]
- A list of paths that match this route.
- preserve
Host boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols string[]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - string[]
- An optional set of strings associated with the route for grouping and filtering.
- headers Mapping[str, str]
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts Sequence[str]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ floatstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods Sequence[str]
- A list of HTTP methods that match this route.
- paths Sequence[str]
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols Sequence[str]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority float - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - Sequence[str]
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect NumberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
AiGatewayMcpServerConversionListenerConfigServer, AiGatewayMcpServerConversionListenerConfigServerArgs
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Session
Ai
Gateway Mcp Server Conversion Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout double
- The timeout for calling the tools in milliseconds. Default: 10000
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Session
Ai
Gateway Mcp Server Conversion Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout float64
- The timeout for calling the tools in milliseconds. Default: 10000
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session object
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Conversion Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Double
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client booleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Conversion Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Conversion Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout float
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session Property Map
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Number
- The timeout for calling the tools in milliseconds. Default: 10000
AiGatewayMcpServerConversionListenerConfigServerSession, AiGatewayMcpServerConversionListenerConfigServerSessionArgs
- Client
Ai
Gateway Mcp Server Conversion Listener Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl double - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- Client
Ai
Gateway Mcp Server Conversion Listener Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl float64 - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client object
- The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis object
- Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Conversion Listener Config Server Session Client - The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Double - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Conversion Listener Config Server Session Client - The configuration for client-side session storage.
- managed boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Conversion Listener Config Server Session Client - The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl float - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy str
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client Property Map
- The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
AiGatewayMcpServerConversionListenerConfigServerSessionClient, AiGatewayMcpServerConversionListenerConfigServerSessionClientArgs
- Secrets List<string>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- Secrets []string
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets list(string)
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets string[]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets Sequence[str]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
AiGatewayMcpServerConversionListenerConfigServerSessionRedis, AiGatewayMcpServerConversionListenerConfigServerSessionRedisArgs
- Cloud
Authentication AiGateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthentication, AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAws, AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAzure, AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationGcp, AiGatewayMcpServerConversionListenerConfigServerSessionRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerConversionListenerConfigServerSessionRedisCluster, AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterNode, AiGatewayMcpServerConversionListenerConfigServerSessionRedisClusterNodeArgs
AiGatewayMcpServerConversionListenerConfigServerSessionRedisKeepalive, AiGatewayMcpServerConversionListenerConfigServerSessionRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinel, AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Conversion Listener Config Server Session Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelNode, AiGatewayMcpServerConversionListenerConfigServerSessionRedisSentinelNodeArgs
AiGatewayMcpServerConversionListenerConfigUpstream, AiGatewayMcpServerConversionListenerConfigUpstreamArgs
- Auth
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- Auth
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth Property Map
- Authentication to use when proxying to the upstream service.
AiGatewayMcpServerConversionListenerConfigUpstreamAuth, AiGatewayMcpServerConversionListenerConfigUpstreamAuthArgs
- Aws
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- Aws
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Conversion Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws Property Map
- AWS IAM (SigV4) authentication for the upstream service.
AiGatewayMcpServerConversionListenerConfigUpstreamAuthAws, AiGatewayMcpServerConversionListenerConfigUpstreamAuthAwsArgs
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ stringid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ stringurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ strid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region str
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token str - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ strurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
AiGatewayMcpServerConversionListenerDatastore, AiGatewayMcpServerConversionListenerDatastoreArgs
- Name string
- An immutable user-defined identifier for this resource. Not Null
- Name string
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name str
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
AiGatewayMcpServerConversionListenerRateLimiting, AiGatewayMcpServerConversionListenerRateLimitingArgs
- Limits
List<Ai
Gateway Mcp Server Conversion Listener Rate Limiting Limit> - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- Limits
[]Ai
Gateway Mcp Server Conversion Listener Rate Limiting Limit - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits list(object)
- The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits
List<Ai
Gateway Mcp Server Conversion Listener Rate Limiting Limit> - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits
Ai
Gateway Mcp Server Conversion Listener Rate Limiting Limit[] - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits
Sequence[Ai
Gateway Mcp Server Conversion Listener Rate Limiting Limit] - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits List<Property Map>
- The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
AiGatewayMcpServerConversionListenerRateLimitingLimit, AiGatewayMcpServerConversionListenerRateLimitingLimitArgs
- Limit double
- The number of requests allowed per window. Not Null
- Method string
- The MCP method this limit applies to.
- Tool string
- The name of the tool this limit applies to.
- Window
Size double - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- Limit float64
- The number of requests allowed per window. Not Null
- Method string
- The MCP method this limit applies to.
- Tool string
- The name of the tool this limit applies to.
- Window
Size float64 - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit number
- The number of requests allowed per window. Not Null
- method string
- The MCP method this limit applies to.
- tool string
- The name of the tool this limit applies to.
- window_
size number - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit Double
- The number of requests allowed per window. Not Null
- method String
- The MCP method this limit applies to.
- tool String
- The name of the tool this limit applies to.
- window
Size Double - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit number
- The number of requests allowed per window. Not Null
- method string
- The MCP method this limit applies to.
- tool string
- The name of the tool this limit applies to.
- window
Size number - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit float
- The number of requests allowed per window. Not Null
- method str
- The MCP method this limit applies to.
- tool str
- The name of the tool this limit applies to.
- window_
size float - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit Number
- The number of requests allowed per window. Not Null
- method String
- The MCP method this limit applies to.
- tool String
- The name of the tool this limit applies to.
- window
Size Number - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
AiGatewayMcpServerConversionListenerTokenVault, AiGatewayMcpServerConversionListenerTokenVaultArgs
- Cache
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Conversion Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Conversion Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- Cache
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Conversion Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Conversion Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache object
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential object
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage object
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ stringtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Conversion Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Conversion Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Conversion Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Conversion Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Conversion Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider str
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Conversion Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ strtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache Property Map
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential Property Map
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage Property Map
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
AiGatewayMcpServerConversionListenerTokenVaultCache, AiGatewayMcpServerConversionListenerTokenVaultCacheArgs
- Redis
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- Redis
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedis, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisArgs
- Cloud
Authentication AiGateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthentication, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAws, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAzure, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationGcp, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisCluster, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterNode, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisClusterNodeArgs
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisKeepalive, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinel, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Conversion Listener Token Vault Cache Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelNode, AiGatewayMcpServerConversionListenerTokenVaultCacheRedisSentinelNodeArgs
AiGatewayMcpServerConversionListenerTokenVaultCredential, AiGatewayMcpServerConversionListenerTokenVaultCredentialArgs
AiGatewayMcpServerConversionListenerTokenVaultCredentialInbound, AiGatewayMcpServerConversionListenerTokenVaultCredentialInboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerConversionListenerTokenVaultCredentialOutbound, AiGatewayMcpServerConversionListenerTokenVaultCredentialOutboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerConversionListenerTokenVaultStorage, AiGatewayMcpServerConversionListenerTokenVaultStorageArgs
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
List<Ai
Gateway Mcp Server Conversion Listener Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
[]Ai
Gateway Mcp Server Conversion Listener Token Vault Storage Key - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys list(object)
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys
List<Ai
Gateway Mcp Server Conversion Listener Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys
Ai
Gateway Mcp Server Conversion Listener Token Vault Storage Key[] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version str - The version of the encryption key used to encrypt new tokens.
- directory str
- The name of the directory in which tokens are stored.
- keys
Sequence[Ai
Gateway Mcp Server Conversion Listener Token Vault Storage Key] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys List<Property Map>
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
AiGatewayMcpServerConversionListenerTokenVaultStorageKey, AiGatewayMcpServerConversionListenerTokenVaultStorageKeyArgs
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key str
- A vault reference to the encryption key. A literal key value is rejected.
- version str
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
AiGatewayMcpServerConversionListenerTool, AiGatewayMcpServerConversionListenerToolArgs
- Access
Ai
Gateway Mcp Server Conversion Listener Tool Access - Access-control rules for a tool.
- Annotations
Ai
Gateway Mcp Server Conversion Listener Tool Annotations - Description string
- A description of what the tool does. Not Null
- Headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- Host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- Method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- Name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- Parameters
List<Ai
Gateway Mcp Server Conversion Listener Tool Parameter> - Path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - Query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- Request
Body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - Responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - Scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- Access
Ai
Gateway Mcp Server Conversion Listener Tool Access - Access-control rules for a tool.
- Annotations
Ai
Gateway Mcp Server Conversion Listener Tool Annotations - Description string
- A description of what the tool does. Not Null
- Headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- Host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- Method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- Name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- Parameters
[]Ai
Gateway Mcp Server Conversion Listener Tool Parameter - Path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - Query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- Request
Body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - Responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - Scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access object
- Access-control rules for a tool.
- annotations object
- description string
- A description of what the tool does. Not Null
- headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters list(object)
- path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request_
body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access
Ai
Gateway Mcp Server Conversion Listener Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Conversion Listener Tool Annotations - description String
- A description of what the tool does. Not Null
- headers String
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host String
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method String
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name String
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters
List<Ai
Gateway Mcp Server Conversion Listener Tool Parameter> - path String
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query String
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request
Body String - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses String
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme String
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access
Ai
Gateway Mcp Server Conversion Listener Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Conversion Listener Tool Annotations - description string
- A description of what the tool does. Not Null
- headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters
Ai
Gateway Mcp Server Conversion Listener Tool Parameter[] - path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request
Body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access
Ai
Gateway Mcp Server Conversion Listener Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Conversion Listener Tool Annotations - description str
- A description of what the tool does. Not Null
- headers str
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host str
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method str
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name str
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters
Sequence[Ai
Gateway Mcp Server Conversion Listener Tool Parameter] - path str
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query str
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request_
body str - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses str
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme str
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access Property Map
- Access-control rules for a tool.
- annotations Property Map
- description String
- A description of what the tool does. Not Null
- headers String
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host String
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method String
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name String
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters List<Property Map>
- path String
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query String
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request
Body String - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses String
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme String
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
AiGatewayMcpServerConversionListenerToolAccess, AiGatewayMcpServerConversionListenerToolAccessArgs
- Acls
Ai
Gateway Mcp Server Conversion Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- Acls
Ai
Gateway Mcp Server Conversion Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Conversion Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Conversion Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Conversion Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls Property Map
- Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
AiGatewayMcpServerConversionListenerToolAccessAcls, AiGatewayMcpServerConversionListenerToolAccessAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerConversionListenerToolAnnotations, AiGatewayMcpServerConversionListenerToolAnnotationsArgs
- Destructive
Hint bool - If true, the tool may perform destructive updates
- Idempotent
Hint bool - If true, repeated calls with same args have no additional effect
- Open
World boolHint - If true, tool interacts with external entities
- Read
Only boolHint - If true, the tool does not modify its environment
- Title string
- Human-readable title for the tool
- Destructive
Hint bool - If true, the tool may perform destructive updates
- Idempotent
Hint bool - If true, repeated calls with same args have no additional effect
- Open
World boolHint - If true, tool interacts with external entities
- Read
Only boolHint - If true, the tool does not modify its environment
- Title string
- Human-readable title for the tool
- destructive_
hint bool - If true, the tool may perform destructive updates
- idempotent_
hint bool - If true, repeated calls with same args have no additional effect
- open_
world_ boolhint - If true, tool interacts with external entities
- read_
only_ boolhint - If true, the tool does not modify its environment
- title string
- Human-readable title for the tool
- destructive
Hint Boolean - If true, the tool may perform destructive updates
- idempotent
Hint Boolean - If true, repeated calls with same args have no additional effect
- open
World BooleanHint - If true, tool interacts with external entities
- read
Only BooleanHint - If true, the tool does not modify its environment
- title String
- Human-readable title for the tool
- destructive
Hint boolean - If true, the tool may perform destructive updates
- idempotent
Hint boolean - If true, repeated calls with same args have no additional effect
- open
World booleanHint - If true, tool interacts with external entities
- read
Only booleanHint - If true, the tool does not modify its environment
- title string
- Human-readable title for the tool
- destructive_
hint bool - If true, the tool may perform destructive updates
- idempotent_
hint bool - If true, repeated calls with same args have no additional effect
- open_
world_ boolhint - If true, tool interacts with external entities
- read_
only_ boolhint - If true, the tool does not modify its environment
- title str
- Human-readable title for the tool
- destructive
Hint Boolean - If true, the tool may perform destructive updates
- idempotent
Hint Boolean - If true, repeated calls with same args have no additional effect
- open
World BooleanHint - If true, tool interacts with external entities
- read
Only BooleanHint - If true, the tool does not modify its environment
- title String
- Human-readable title for the tool
AiGatewayMcpServerConversionListenerToolParameter, AiGatewayMcpServerConversionListenerToolParameterArgs
- Description string
- A description of the parameter.
- In string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- Name string
- The name of the parameter. Not Null
- Required bool
- Whether this parameter is required.
- Schema Dictionary<string, string>
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- Description string
- A description of the parameter.
- In string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- Name string
- The name of the parameter. Not Null
- Required bool
- Whether this parameter is required.
- Schema map[string]string
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description string
- A description of the parameter.
- in string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name string
- The name of the parameter. Not Null
- required bool
- Whether this parameter is required.
- schema map(string)
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description String
- A description of the parameter.
- in String
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name String
- The name of the parameter. Not Null
- required Boolean
- Whether this parameter is required.
- schema Map<String,String>
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description string
- A description of the parameter.
- in string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name string
- The name of the parameter. Not Null
- required boolean
- Whether this parameter is required.
- schema {[key: string]: string}
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description str
- A description of the parameter.
- in_ str
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name str
- The name of the parameter. Not Null
- required bool
- Whether this parameter is required.
- schema Mapping[str, str]
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description String
- A description of the parameter.
- in String
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name String
- The name of the parameter. Not Null
- required Boolean
- Whether this parameter is required.
- schema Map<String>
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
AiGatewayMcpServerConversionOnly, AiGatewayMcpServerConversionOnlyArgs
- Config
Ai
Gateway Mcp Server Conversion Only Config - Routing, logging, and request body size limits for the MCP Server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
List<Ai
Gateway Mcp Server Conversion Only Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies List<string>
- List of policy references.
- Token
Vault AiGateway Mcp Server Conversion Only Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
List<Ai
Gateway Mcp Server Conversion Only Tool> - List of tools exposed by this MCP Server. Not Null
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Mcp Server Conversion Only Config - Routing, logging, and request body size limits for the MCP Server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
[]Ai
Gateway Mcp Server Conversion Only Datastore - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies []string
- List of policy references.
- Token
Vault AiGateway Mcp Server Conversion Only Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
[]Ai
Gateway Mcp Server Conversion Only Tool - List of tools exposed by this MCP Server. Not Null
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Routing, logging, and request body size limits for the MCP Server. Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- datastores list(object)
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name string - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by map(string) - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies list(string)
- List of policy references.
- token_
vault object Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools list(object)
- List of tools exposed by this MCP Server. Not Null
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Mcp Server Conversion Only Config - Routing, logging, and request body size limits for the MCP Server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores
List<Ai
Gateway Mcp Server Conversion Only Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- token
Vault AiGateway Mcp Server Conversion Only Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
List<Ai
Gateway Mcp Server Conversion Only Tool> - List of tools exposed by this MCP Server. Not Null
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Mcp Server Conversion Only Config - Routing, logging, and request body size limits for the MCP Server. Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- datastores
Ai
Gateway Mcp Server Conversion Only Datastore[] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name string - The display name for the MCP Server.
- enabled boolean
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies string[]
- List of policy references.
- token
Vault AiGateway Mcp Server Conversion Only Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Ai
Gateway Mcp Server Conversion Only Tool[] - List of tools exposed by this MCP Server. Not Null
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Mcp Server Conversion Only Config - Routing, logging, and request body size limits for the MCP Server. Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- datastores
Sequence[Ai
Gateway Mcp Server Conversion Only Datastore] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name str - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies Sequence[str]
- List of policy references.
- token_
vault AiGateway Mcp Server Conversion Only Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Sequence[Ai
Gateway Mcp Server Conversion Only Tool] - List of tools exposed by this MCP Server. Not Null
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Routing, logging, and request body size limits for the MCP Server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores List<Property Map>
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- token
Vault Property Map Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools List<Property Map>
- List of tools exposed by this MCP Server. Not Null
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayMcpServerConversionOnlyConfig, AiGatewayMcpServerConversionOnlyConfigArgs
- Ca
Certificates List<string> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - Certificates List<string>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Conversion Only Config Logging - Configuration for AI Gateway logging.
- Max
Request doubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Conversion Only Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Upstream
Ai
Gateway Mcp Server Conversion Only Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- Ca
Certificates []string - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - Certificates []string
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Conversion Only Config Logging - Configuration for AI Gateway logging.
- Max
Request float64Body Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Conversion Only Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Upstream
Ai
Gateway Mcp Server Conversion Only Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca_
certificates list(string) - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates list(string)
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging object
- Configuration for AI Gateway logging.
- max_
request_ numberbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route object
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - upstream object
- Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates List<String> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Conversion Only Config Logging - Configuration for AI Gateway logging.
- max
Request DoubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Conversion Only Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - upstream
Ai
Gateway Mcp Server Conversion Only Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates string[] - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates string[]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Conversion Only Config Logging - Configuration for AI Gateway logging.
- max
Request numberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Conversion Only Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - upstream
Ai
Gateway Mcp Server Conversion Only Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca_
certificates Sequence[str] - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates Sequence[str]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Conversion Only Config Logging - Configuration for AI Gateway logging.
- max_
request_ floatbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Conversion Only Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - upstream
Ai
Gateway Mcp Server Conversion Only Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url str
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates List<String> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging Property Map
- Configuration for AI Gateway logging.
- max
Request NumberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route Property Map
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - upstream Property Map
- Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
AiGatewayMcpServerConversionOnlyConfigLogging, AiGatewayMcpServerConversionOnlyConfigLoggingArgs
AiGatewayMcpServerConversionOnlyConfigRoute, AiGatewayMcpServerConversionOnlyConfigRouteArgs
- Headers Dictionary<string, string>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts List<string>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect doubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods List<string>
- A list of HTTP methods that match this route.
- Paths List<string>
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols List<string>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<string>
- An optional set of strings associated with the route for grouping and filtering.
- Headers map[string]string
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts []string
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect float64Status Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods []string
- A list of HTTP methods that match this route.
- Paths []string
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols []string
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority float64 - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - []string
- An optional set of strings associated with the route for grouping and filtering.
- headers map(string)
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts list(string)
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ numberstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods list(string)
- A list of HTTP methods that match this route.
- paths list(string)
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols list(string)
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - list(string)
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String,String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect DoubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
- headers {[key: string]: string}
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts string[]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect numberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods string[]
- A list of HTTP methods that match this route.
- paths string[]
- A list of paths that match this route.
- preserve
Host boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols string[]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - string[]
- An optional set of strings associated with the route for grouping and filtering.
- headers Mapping[str, str]
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts Sequence[str]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ floatstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods Sequence[str]
- A list of HTTP methods that match this route.
- paths Sequence[str]
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols Sequence[str]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority float - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - Sequence[str]
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect NumberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
AiGatewayMcpServerConversionOnlyConfigUpstream, AiGatewayMcpServerConversionOnlyConfigUpstreamArgs
- Auth
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth - Authentication to use when proxying to the upstream service.
- Auth
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth Property Map
- Authentication to use when proxying to the upstream service.
AiGatewayMcpServerConversionOnlyConfigUpstreamAuth, AiGatewayMcpServerConversionOnlyConfigUpstreamAuthArgs
- Aws
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- Aws
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Conversion Only Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws Property Map
- AWS IAM (SigV4) authentication for the upstream service.
AiGatewayMcpServerConversionOnlyConfigUpstreamAuthAws, AiGatewayMcpServerConversionOnlyConfigUpstreamAuthAwsArgs
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ stringid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ stringurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ strid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region str
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token str - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ strurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
AiGatewayMcpServerConversionOnlyDatastore, AiGatewayMcpServerConversionOnlyDatastoreArgs
- Name string
- An immutable user-defined identifier for this resource. Not Null
- Name string
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name str
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
AiGatewayMcpServerConversionOnlyTokenVault, AiGatewayMcpServerConversionOnlyTokenVaultArgs
- Cache
Ai
Gateway Mcp Server Conversion Only Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Conversion Only Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Conversion Only Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- Cache
Ai
Gateway Mcp Server Conversion Only Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Conversion Only Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Conversion Only Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache object
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential object
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage object
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ stringtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Conversion Only Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Conversion Only Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Conversion Only Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Conversion Only Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Conversion Only Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Conversion Only Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Conversion Only Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Conversion Only Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider str
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Conversion Only Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ strtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache Property Map
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential Property Map
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage Property Map
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
AiGatewayMcpServerConversionOnlyTokenVaultCache, AiGatewayMcpServerConversionOnlyTokenVaultCacheArgs
- Redis
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- Redis
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedis, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisArgs
- Cloud
Authentication AiGateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthentication, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationAws, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationAzure, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationGcp, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisCluster, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterNode, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisClusterNodeArgs
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisKeepalive, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinel, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Conversion Only Token Vault Cache Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelNode, AiGatewayMcpServerConversionOnlyTokenVaultCacheRedisSentinelNodeArgs
AiGatewayMcpServerConversionOnlyTokenVaultCredential, AiGatewayMcpServerConversionOnlyTokenVaultCredentialArgs
AiGatewayMcpServerConversionOnlyTokenVaultCredentialInbound, AiGatewayMcpServerConversionOnlyTokenVaultCredentialInboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerConversionOnlyTokenVaultCredentialOutbound, AiGatewayMcpServerConversionOnlyTokenVaultCredentialOutboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerConversionOnlyTokenVaultStorage, AiGatewayMcpServerConversionOnlyTokenVaultStorageArgs
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
List<Ai
Gateway Mcp Server Conversion Only Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
[]Ai
Gateway Mcp Server Conversion Only Token Vault Storage Key - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys list(object)
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys
List<Ai
Gateway Mcp Server Conversion Only Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys
Ai
Gateway Mcp Server Conversion Only Token Vault Storage Key[] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version str - The version of the encryption key used to encrypt new tokens.
- directory str
- The name of the directory in which tokens are stored.
- keys
Sequence[Ai
Gateway Mcp Server Conversion Only Token Vault Storage Key] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys List<Property Map>
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
AiGatewayMcpServerConversionOnlyTokenVaultStorageKey, AiGatewayMcpServerConversionOnlyTokenVaultStorageKeyArgs
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key str
- A vault reference to the encryption key. A literal key value is rejected.
- version str
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
AiGatewayMcpServerConversionOnlyTool, AiGatewayMcpServerConversionOnlyToolArgs
- Access
Ai
Gateway Mcp Server Conversion Only Tool Access - Access-control rules for a tool.
- Annotations
Ai
Gateway Mcp Server Conversion Only Tool Annotations - Description string
- A description of what the tool does. Not Null
- Headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- Host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- Method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- Name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- Parameters
List<Ai
Gateway Mcp Server Conversion Only Tool Parameter> - Path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - Query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- Request
Body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - Responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - Scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- Access
Ai
Gateway Mcp Server Conversion Only Tool Access - Access-control rules for a tool.
- Annotations
Ai
Gateway Mcp Server Conversion Only Tool Annotations - Description string
- A description of what the tool does. Not Null
- Headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- Host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- Method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- Name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- Parameters
[]Ai
Gateway Mcp Server Conversion Only Tool Parameter - Path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - Query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- Request
Body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - Responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - Scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access object
- Access-control rules for a tool.
- annotations object
- description string
- A description of what the tool does. Not Null
- headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters list(object)
- path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request_
body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access
Ai
Gateway Mcp Server Conversion Only Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Conversion Only Tool Annotations - description String
- A description of what the tool does. Not Null
- headers String
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host String
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method String
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name String
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters
List<Ai
Gateway Mcp Server Conversion Only Tool Parameter> - path String
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query String
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request
Body String - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses String
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme String
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access
Ai
Gateway Mcp Server Conversion Only Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Conversion Only Tool Annotations - description string
- A description of what the tool does. Not Null
- headers string
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host string
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method string
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters
Ai
Gateway Mcp Server Conversion Only Tool Parameter[] - path string
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query string
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request
Body string - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses string
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme string
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access
Ai
Gateway Mcp Server Conversion Only Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Conversion Only Tool Annotations - description str
- A description of what the tool does. Not Null
- headers str
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host str
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method str
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name str
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters
Sequence[Ai
Gateway Mcp Server Conversion Only Tool Parameter] - path str
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query str
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request_
body str - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses str
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme str
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
- access Property Map
- Access-control rules for a tool.
- annotations Property Map
- description String
- A description of what the tool does. Not Null
- headers String
- The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required. Parsed as JSON.
- host String
- The host used when forwarding the request to the upstream API. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required.
- method String
- The HTTP method used when forwarding the request to the upstream API. possible known values include one of ["DELETE", "GET", "PATCH", "POST", "PUT"]; Not Null
- name String
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- parameters List<Property Map>
- path String
- The path of the exported API. Always treated as relative to the path component of
config.urland simply concatenated onto it — a leading/has no special "absolute path" meaning. If this tool'shostorschemeoverrides the source's URL,pathis instead relative to the root of that overridden host, since there is no URL path from a different host to append to. By default, Kong will extract the path from API configuration. - query String
- The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required. Parsed as JSON.
- request
Body String - The API requestBody specification defined in OpenAPI JSON format. For example, '{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"color":{"type":"array","items":{"type":"string"}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that
$refis not supported. Parsed as JSON. - responses String
- The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"type":"string"}}}}}}}}'. See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details. Only one non-error (status code < 400) response is supported. Note that
$refis not supported. Parsed as JSON. - scheme String
- The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it. possible known values include one of ["http", "https"]
AiGatewayMcpServerConversionOnlyToolAccess, AiGatewayMcpServerConversionOnlyToolAccessArgs
- Acls
Ai
Gateway Mcp Server Conversion Only Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- Acls
Ai
Gateway Mcp Server Conversion Only Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Conversion Only Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Conversion Only Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Conversion Only Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls Property Map
- Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
AiGatewayMcpServerConversionOnlyToolAccessAcls, AiGatewayMcpServerConversionOnlyToolAccessAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerConversionOnlyToolAnnotations, AiGatewayMcpServerConversionOnlyToolAnnotationsArgs
- Destructive
Hint bool - If true, the tool may perform destructive updates
- Idempotent
Hint bool - If true, repeated calls with same args have no additional effect
- Open
World boolHint - If true, tool interacts with external entities
- Read
Only boolHint - If true, the tool does not modify its environment
- Title string
- Human-readable title for the tool
- Destructive
Hint bool - If true, the tool may perform destructive updates
- Idempotent
Hint bool - If true, repeated calls with same args have no additional effect
- Open
World boolHint - If true, tool interacts with external entities
- Read
Only boolHint - If true, the tool does not modify its environment
- Title string
- Human-readable title for the tool
- destructive_
hint bool - If true, the tool may perform destructive updates
- idempotent_
hint bool - If true, repeated calls with same args have no additional effect
- open_
world_ boolhint - If true, tool interacts with external entities
- read_
only_ boolhint - If true, the tool does not modify its environment
- title string
- Human-readable title for the tool
- destructive
Hint Boolean - If true, the tool may perform destructive updates
- idempotent
Hint Boolean - If true, repeated calls with same args have no additional effect
- open
World BooleanHint - If true, tool interacts with external entities
- read
Only BooleanHint - If true, the tool does not modify its environment
- title String
- Human-readable title for the tool
- destructive
Hint boolean - If true, the tool may perform destructive updates
- idempotent
Hint boolean - If true, repeated calls with same args have no additional effect
- open
World booleanHint - If true, tool interacts with external entities
- read
Only booleanHint - If true, the tool does not modify its environment
- title string
- Human-readable title for the tool
- destructive_
hint bool - If true, the tool may perform destructive updates
- idempotent_
hint bool - If true, repeated calls with same args have no additional effect
- open_
world_ boolhint - If true, tool interacts with external entities
- read_
only_ boolhint - If true, the tool does not modify its environment
- title str
- Human-readable title for the tool
- destructive
Hint Boolean - If true, the tool may perform destructive updates
- idempotent
Hint Boolean - If true, repeated calls with same args have no additional effect
- open
World BooleanHint - If true, tool interacts with external entities
- read
Only BooleanHint - If true, the tool does not modify its environment
- title String
- Human-readable title for the tool
AiGatewayMcpServerConversionOnlyToolParameter, AiGatewayMcpServerConversionOnlyToolParameterArgs
- Description string
- A description of the parameter.
- In string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- Name string
- The name of the parameter. Not Null
- Required bool
- Whether this parameter is required.
- Schema Dictionary<string, string>
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- Description string
- A description of the parameter.
- In string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- Name string
- The name of the parameter. Not Null
- Required bool
- Whether this parameter is required.
- Schema map[string]string
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description string
- A description of the parameter.
- in string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name string
- The name of the parameter. Not Null
- required bool
- Whether this parameter is required.
- schema map(string)
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description String
- A description of the parameter.
- in String
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name String
- The name of the parameter. Not Null
- required Boolean
- Whether this parameter is required.
- schema Map<String,String>
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description string
- A description of the parameter.
- in string
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name string
- The name of the parameter. Not Null
- required boolean
- Whether this parameter is required.
- schema {[key: string]: string}
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description str
- A description of the parameter.
- in_ str
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name str
- The name of the parameter. Not Null
- required bool
- Whether this parameter is required.
- schema Mapping[str, str]
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
- description String
- A description of the parameter.
- in String
- The location of the parameter in the request. possible known values include one of ["query", "path", "header", "body"]; Not Null
- name String
- The name of the parameter. Not Null
- required Boolean
- Whether this parameter is required.
- schema Map<String>
- JSON Schema definition for the parameter value. See https://swagger.io/docs/specification/v3_0/describing-parameters/#schema-vs-content for more details.
AiGatewayMcpServerListener, AiGatewayMcpServerListenerArgs
- Access
Ai
Gateway Mcp Server Listener Access - Config
Ai
Gateway Mcp Server Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
List<Ai
Gateway Mcp Server Listener Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies List<string>
- List of policy references.
- Sources List<string>
- The explicit list of source MCP Servers whose tools this listener exposes.
Each entry is the immutable
nameof aconversion-only(toolset) orupstream-server(third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. Not Null - Token
Vault AiGateway Mcp Server Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Access
Ai
Gateway Mcp Server Listener Access - Config
Ai
Gateway Mcp Server Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
[]Ai
Gateway Mcp Server Listener Datastore - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies []string
- List of policy references.
- Sources []string
- The explicit list of source MCP Servers whose tools this listener exposes.
Each entry is the immutable
nameof aconversion-only(toolset) orupstream-server(third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. Not Null - Token
Vault AiGateway Mcp Server Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- access object
- config object
- Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- datastores list(object)
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name string - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by map(string) - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies list(string)
- List of policy references.
- sources list(string)
- The explicit list of source MCP Servers whose tools this listener exposes.
Each entry is the immutable
nameof aconversion-only(toolset) orupstream-server(third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. Not Null - token_
vault object Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Listener Access - config
Ai
Gateway Mcp Server Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores
List<Ai
Gateway Mcp Server Listener Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- sources List<String>
- The explicit list of source MCP Servers whose tools this listener exposes.
Each entry is the immutable
nameof aconversion-only(toolset) orupstream-server(third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. Not Null - token
Vault AiGateway Mcp Server Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- updated
At String - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Listener Access - config
Ai
Gateway Mcp Server Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- datastores
Ai
Gateway Mcp Server Listener Datastore[] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name string - The display name for the MCP Server.
- enabled boolean
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies string[]
- List of policy references.
- sources string[]
- The explicit list of source MCP Servers whose tools this listener exposes.
Each entry is the immutable
nameof aconversion-only(toolset) orupstream-server(third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. Not Null - token
Vault AiGateway Mcp Server Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- updated
At string - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Listener Access - config
Ai
Gateway Mcp Server Listener Config - Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- datastores
Sequence[Ai
Gateway Mcp Server Listener Datastore] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name str - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies Sequence[str]
- List of policy references.
- sources Sequence[str]
- The explicit list of source MCP Servers whose tools this listener exposes.
Each entry is the immutable
nameof aconversion-only(toolset) orupstream-server(third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. Not Null - token_
vault AiGateway Mcp Server Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- access Property Map
- config Property Map
- Server-side configuration specific to modes where Kong answers as the MCP server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores List<Property Map>
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- sources List<String>
- The explicit list of source MCP Servers whose tools this listener exposes.
Each entry is the immutable
nameof aconversion-only(toolset) orupstream-server(third-party MCP server) MCP Server in the same AI Gateway. All of the referenced source's tools are exposed. Not Null - token
Vault Property Map Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayMcpServerListenerAccess, AiGatewayMcpServerListenerAccessArgs
- Consumer
Ai
Gateway Mcp Server Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Oauth
Access AiToken Gateway Mcp Server Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Consumer
Ai
Gateway Mcp Server Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Oauth
Access AiToken Gateway Mcp Server Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer object
- Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth_
access_ objecttoken - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access AiToken Gateway Mcp Server Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access AiToken Gateway Mcp Server Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth_
access_ Aitoken Gateway Mcp Server Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer Property Map
- Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access Property MapToken - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
AiGatewayMcpServerListenerAccessConsumer, AiGatewayMcpServerListenerAccessConsumerArgs
- Acls
Ai
Gateway Mcp Server Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies List<string> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers List<string> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- Acls
Ai
Gateway Mcp Server Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies []string - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers []string - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls object
- Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies list(string) - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ objectacls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers list(string) - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata object
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies string[] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers string[] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies Sequence[str] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ Aiacls Gateway Mcp Server Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers Sequence[str] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls Property Map
- Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool Property MapAcls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata Property Map
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
AiGatewayMcpServerListenerAccessConsumerAcls, AiGatewayMcpServerListenerAccessConsumerAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
AiGatewayMcpServerListenerAccessConsumerDefaultToolAcls, AiGatewayMcpServerListenerAccessConsumerDefaultToolAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerListenerAccessConsumerMetadata, AiGatewayMcpServerListenerAccessConsumerMetadataArgs
- List<string>
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds List<string> - List of OAuth scopes supported by the protected resource.
- []string
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds []string - List of OAuth scopes supported by the protected resource.
- list(string)
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes_
supporteds list(string) - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
- string[]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes
Supporteds string[] - List of OAuth scopes supported by the protected resource.
- Sequence[str]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint str - The authorization server metadata discovery URL.
- endpoint str
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource str
- The protected resource's identifier (resource URI).
- scopes_
supporteds Sequence[str] - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
AiGatewayMcpServerListenerAccessOauthAccessToken, AiGatewayMcpServerListenerAccessOauthAccessTokenArgs
- Access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - Acls
Ai
Gateway Mcp Server Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies List<string> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers List<string> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- Access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - Acls
Ai
Gateway Mcp Server Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies []string - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers []string - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access_
token_ stringclaim_ field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls object
- Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies list(string) - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ objectacls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers list(string) - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata object
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token StringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies string[] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers string[] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access_
token_ strclaim_ field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies Sequence[str] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ Aiacls Gateway Mcp Server Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers Sequence[str] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token StringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls Property Map
- Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool Property MapAcls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata Property Map
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
AiGatewayMcpServerListenerAccessOauthAccessTokenAcls, AiGatewayMcpServerListenerAccessOauthAccessTokenAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
AiGatewayMcpServerListenerAccessOauthAccessTokenDefaultToolAcls, AiGatewayMcpServerListenerAccessOauthAccessTokenDefaultToolAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerListenerAccessOauthAccessTokenMetadata, AiGatewayMcpServerListenerAccessOauthAccessTokenMetadataArgs
- List<string>
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds List<string> - List of OAuth scopes supported by the protected resource.
- []string
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds []string - List of OAuth scopes supported by the protected resource.
- list(string)
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes_
supporteds list(string) - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
- string[]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes
Supporteds string[] - List of OAuth scopes supported by the protected resource.
- Sequence[str]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint str - The authorization server metadata discovery URL.
- endpoint str
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource str
- The protected resource's identifier (resource URI).
- scopes_
supporteds Sequence[str] - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
AiGatewayMcpServerListenerConfig, AiGatewayMcpServerListenerConfigArgs
- Allowed
Versions List<string> - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - Cache
Ai
Gateway Mcp Server Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- Logging
Ai
Gateway Mcp Server Listener Config Logging - Configuration for AI Gateway logging.
- Max
Request doubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Listener Config Server - Server-side configuration for the MCP Server.
- Allowed
Versions []string - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - Cache
Ai
Gateway Mcp Server Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- Logging
Ai
Gateway Mcp Server Listener Config Logging - Configuration for AI Gateway logging.
- Max
Request float64Body Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Listener Config Server - Server-side configuration for the MCP Server.
- allowed_
versions list(string) - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - cache object
Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- logging object
- Configuration for AI Gateway logging.
- max_
request_ numberbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route object
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server object
- Server-side configuration for the MCP Server.
- allowed
Versions List<String> - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - cache
Ai
Gateway Mcp Server Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- logging
Ai
Gateway Mcp Server Listener Config Logging - Configuration for AI Gateway logging.
- max
Request DoubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Listener Config Server - Server-side configuration for the MCP Server.
- allowed
Versions string[] - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - cache
Ai
Gateway Mcp Server Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- logging
Ai
Gateway Mcp Server Listener Config Logging - Configuration for AI Gateway logging.
- max
Request numberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Listener Config Server - Server-side configuration for the MCP Server.
- allowed_
versions Sequence[str] - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - cache
Ai
Gateway Mcp Server Listener Config Cache Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- logging
Ai
Gateway Mcp Server Listener Config Logging - Configuration for AI Gateway logging.
- max_
request_ floatbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Listener Config Server - Server-side configuration for the MCP Server.
- allowed
Versions List<String> - The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong
implements, which is the default. When set,
server/discoveradvertises exactly this list and a request declaring anything else is rejected. Listing only per-request revisions refuses handshake clients. - cache Property Map
Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them.
Requires a minimum runtime version of
2.1.- logging Property Map
- Configuration for AI Gateway logging.
- max
Request NumberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route Property Map
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server Property Map
- Server-side configuration for the MCP Server.
AiGatewayMcpServerListenerConfigCache, AiGatewayMcpServerListenerConfigCacheArgs
- Discover
Ai
Gateway Mcp Server Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- Tools
List AiGateway Mcp Server Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- Discover
Ai
Gateway Mcp Server Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- Tools
List AiGateway Mcp Server Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover object
- A cache hint Kong emits on a cacheable operation it serves.
- tools_
list object - A cache hint Kong emits on a cacheable operation it serves.
- discover
Ai
Gateway Mcp Server Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- tools
List AiGateway Mcp Server Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover
Ai
Gateway Mcp Server Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- tools
List AiGateway Mcp Server Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover
Ai
Gateway Mcp Server Listener Config Cache Discover - A cache hint Kong emits on a cacheable operation it serves.
- tools_
list AiGateway Mcp Server Listener Config Cache Tools List - A cache hint Kong emits on a cacheable operation it serves.
- discover Property Map
- A cache hint Kong emits on a cacheable operation it serves.
- tools
List Property Map - A cache hint Kong emits on a cacheable operation it serves.
AiGatewayMcpServerListenerConfigCacheDiscover, AiGatewayMcpServerListenerConfigCacheDiscoverArgs
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms double - How long a client may treat the result as fresh, in milliseconds.
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms float64 - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms number - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Double - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms number - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope str - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms float - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Number - How long a client may treat the result as fresh, in milliseconds.
AiGatewayMcpServerListenerConfigCacheToolsList, AiGatewayMcpServerListenerConfigCacheToolsListArgs
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms double - How long a client may treat the result as fresh, in milliseconds.
- Cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - Ttl
Ms float64 - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms number - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Double - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope string - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms number - How long a client may treat the result as fresh, in milliseconds.
- cache_
scope str - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl_
ms float - How long a client may treat the result as fresh, in milliseconds.
- cache
Scope String - Whether the result may be cached across authorization contexts.
publicis rejected when the server's tool list is filtered per subject bydefault_tool_aclsor a tool's ownaccess.acls. possible known values include one of ["public", "private"]; Default: "private" - ttl
Ms Number - How long a client may treat the result as fresh, in milliseconds.
AiGatewayMcpServerListenerConfigLogging, AiGatewayMcpServerListenerConfigLoggingArgs
AiGatewayMcpServerListenerConfigRoute, AiGatewayMcpServerListenerConfigRouteArgs
- Headers Dictionary<string, string>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts List<string>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect doubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods List<string>
- A list of HTTP methods that match this route.
- Paths List<string>
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols List<string>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<string>
- An optional set of strings associated with the route for grouping and filtering.
- Headers map[string]string
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts []string
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect float64Status Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods []string
- A list of HTTP methods that match this route.
- Paths []string
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols []string
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority float64 - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - []string
- An optional set of strings associated with the route for grouping and filtering.
- headers map(string)
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts list(string)
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ numberstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods list(string)
- A list of HTTP methods that match this route.
- paths list(string)
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols list(string)
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - list(string)
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String,String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect DoubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
- headers {[key: string]: string}
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts string[]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect numberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods string[]
- A list of HTTP methods that match this route.
- paths string[]
- A list of paths that match this route.
- preserve
Host boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols string[]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - string[]
- An optional set of strings associated with the route for grouping and filtering.
- headers Mapping[str, str]
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts Sequence[str]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ floatstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods Sequence[str]
- A list of HTTP methods that match this route.
- paths Sequence[str]
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols Sequence[str]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority float - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - Sequence[str]
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect NumberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
AiGatewayMcpServerListenerConfigServer, AiGatewayMcpServerListenerConfigServerArgs
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Session
Ai
Gateway Mcp Server Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout double
- The timeout for calling the tools in milliseconds. Default: 10000
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Session
Ai
Gateway Mcp Server Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout float64
- The timeout for calling the tools in milliseconds. Default: 10000
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session object
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Double
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client booleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout float
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session Property Map
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Number
- The timeout for calling the tools in milliseconds. Default: 10000
AiGatewayMcpServerListenerConfigServerSession, AiGatewayMcpServerListenerConfigServerSessionArgs
- Client
Ai
Gateway Mcp Server Listener Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl double - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- Client
Ai
Gateway Mcp Server Listener Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl float64 - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client object
- The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis object
- Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Listener Config Server Session Client - The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Double - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Listener Config Server Session Client - The configuration for client-side session storage.
- managed boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Listener Config Server Session Client - The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl float - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy str
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client Property Map
- The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
AiGatewayMcpServerListenerConfigServerSessionClient, AiGatewayMcpServerListenerConfigServerSessionClientArgs
- Secrets List<string>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- Secrets []string
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets list(string)
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets string[]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets Sequence[str]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
AiGatewayMcpServerListenerConfigServerSessionRedis, AiGatewayMcpServerListenerConfigServerSessionRedisArgs
- Cloud
Authentication AiGateway Mcp Server Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthentication, AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationAws, AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationAzure, AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationGcp, AiGatewayMcpServerListenerConfigServerSessionRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerListenerConfigServerSessionRedisCluster, AiGatewayMcpServerListenerConfigServerSessionRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Listener Config Server Session Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerListenerConfigServerSessionRedisClusterNode, AiGatewayMcpServerListenerConfigServerSessionRedisClusterNodeArgs
AiGatewayMcpServerListenerConfigServerSessionRedisKeepalive, AiGatewayMcpServerListenerConfigServerSessionRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerListenerConfigServerSessionRedisSentinel, AiGatewayMcpServerListenerConfigServerSessionRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Listener Config Server Session Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerListenerConfigServerSessionRedisSentinelNode, AiGatewayMcpServerListenerConfigServerSessionRedisSentinelNodeArgs
AiGatewayMcpServerListenerDatastore, AiGatewayMcpServerListenerDatastoreArgs
- Name string
- An immutable user-defined identifier for this resource. Not Null
- Name string
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name str
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
AiGatewayMcpServerListenerTokenVault, AiGatewayMcpServerListenerTokenVaultArgs
- Cache
Ai
Gateway Mcp Server Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- Cache
Ai
Gateway Mcp Server Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache object
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential object
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage object
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ stringtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider str
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ strtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache Property Map
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential Property Map
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage Property Map
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
AiGatewayMcpServerListenerTokenVaultCache, AiGatewayMcpServerListenerTokenVaultCacheArgs
- Redis
Ai
Gateway Mcp Server Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- Redis
Ai
Gateway Mcp Server Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
AiGatewayMcpServerListenerTokenVaultCacheRedis, AiGatewayMcpServerListenerTokenVaultCacheRedisArgs
- Cloud
Authentication AiGateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthentication, AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAws, AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAzure, AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationGcp, AiGatewayMcpServerListenerTokenVaultCacheRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerListenerTokenVaultCacheRedisCluster, AiGatewayMcpServerListenerTokenVaultCacheRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Listener Token Vault Cache Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerListenerTokenVaultCacheRedisClusterNode, AiGatewayMcpServerListenerTokenVaultCacheRedisClusterNodeArgs
AiGatewayMcpServerListenerTokenVaultCacheRedisKeepalive, AiGatewayMcpServerListenerTokenVaultCacheRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerListenerTokenVaultCacheRedisSentinel, AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Listener Token Vault Cache Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelNode, AiGatewayMcpServerListenerTokenVaultCacheRedisSentinelNodeArgs
AiGatewayMcpServerListenerTokenVaultCredential, AiGatewayMcpServerListenerTokenVaultCredentialArgs
AiGatewayMcpServerListenerTokenVaultCredentialInbound, AiGatewayMcpServerListenerTokenVaultCredentialInboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerListenerTokenVaultCredentialOutbound, AiGatewayMcpServerListenerTokenVaultCredentialOutboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerListenerTokenVaultStorage, AiGatewayMcpServerListenerTokenVaultStorageArgs
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
List<Ai
Gateway Mcp Server Listener Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
[]Ai
Gateway Mcp Server Listener Token Vault Storage Key - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys list(object)
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys
List<Ai
Gateway Mcp Server Listener Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys
Ai
Gateway Mcp Server Listener Token Vault Storage Key[] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version str - The version of the encryption key used to encrypt new tokens.
- directory str
- The name of the directory in which tokens are stored.
- keys
Sequence[Ai
Gateway Mcp Server Listener Token Vault Storage Key] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys List<Property Map>
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
AiGatewayMcpServerListenerTokenVaultStorageKey, AiGatewayMcpServerListenerTokenVaultStorageKeyArgs
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key str
- A vault reference to the encryption key. A literal key value is rejected.
- version str
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
AiGatewayMcpServerPassthroughListener, AiGatewayMcpServerPassthroughListenerArgs
- Access
Ai
Gateway Mcp Server Passthrough Listener Access - Config
Ai
Gateway Mcp Server Passthrough Listener Config - Routing, logging, and server configuration for the MCP Server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
List<Ai
Gateway Mcp Server Passthrough Listener Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies List<string>
- List of policy references.
- Rate
Limiting AiGateway Mcp Server Passthrough Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- Token
Vault AiGateway Mcp Server Passthrough Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
List<Ai
Gateway Mcp Server Passthrough Listener Tool> - Per-tool access-control overrides for tools advertised by the remote MCP Server. Each
entry is matched to a remote tool by
name; only its access-control rules are applied. - Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Access
Ai
Gateway Mcp Server Passthrough Listener Access - Config
Ai
Gateway Mcp Server Passthrough Listener Config - Routing, logging, and server configuration for the MCP Server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
[]Ai
Gateway Mcp Server Passthrough Listener Datastore - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies []string
- List of policy references.
- Rate
Limiting AiGateway Mcp Server Passthrough Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- Token
Vault AiGateway Mcp Server Passthrough Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
[]Ai
Gateway Mcp Server Passthrough Listener Tool - Per-tool access-control overrides for tools advertised by the remote MCP Server. Each
entry is matched to a remote tool by
name; only its access-control rules are applied. - Updated
At string - An ISO-8601 timestamp representation of entity update date.
- access object
- config object
- Routing, logging, and server configuration for the MCP Server. Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- datastores list(object)
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name string - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by map(string) - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies list(string)
- List of policy references.
- rate_
limiting object Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token_
vault object Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools list(object)
- Per-tool access-control overrides for tools advertised by the remote MCP Server. Each
entry is matched to a remote tool by
name; only its access-control rules are applied. - updated_
at string - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Passthrough Listener Access - config
Ai
Gateway Mcp Server Passthrough Listener Config - Routing, logging, and server configuration for the MCP Server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores
List<Ai
Gateway Mcp Server Passthrough Listener Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- rate
Limiting AiGateway Mcp Server Passthrough Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token
Vault AiGateway Mcp Server Passthrough Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
List<Ai
Gateway Mcp Server Passthrough Listener Tool> - Per-tool access-control overrides for tools advertised by the remote MCP Server. Each
entry is matched to a remote tool by
name; only its access-control rules are applied. - updated
At String - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Passthrough Listener Access - config
Ai
Gateway Mcp Server Passthrough Listener Config - Routing, logging, and server configuration for the MCP Server. Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- datastores
Ai
Gateway Mcp Server Passthrough Listener Datastore[] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name string - The display name for the MCP Server.
- enabled boolean
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies string[]
- List of policy references.
- rate
Limiting AiGateway Mcp Server Passthrough Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token
Vault AiGateway Mcp Server Passthrough Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Ai
Gateway Mcp Server Passthrough Listener Tool[] - Per-tool access-control overrides for tools advertised by the remote MCP Server. Each
entry is matched to a remote tool by
name; only its access-control rules are applied. - updated
At string - An ISO-8601 timestamp representation of entity update date.
- access
Ai
Gateway Mcp Server Passthrough Listener Access - config
Ai
Gateway Mcp Server Passthrough Listener Config - Routing, logging, and server configuration for the MCP Server. Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- datastores
Sequence[Ai
Gateway Mcp Server Passthrough Listener Datastore] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name str - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies Sequence[str]
- List of policy references.
- rate_
limiting AiGateway Mcp Server Passthrough Listener Rate Limiting Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token_
vault AiGateway Mcp Server Passthrough Listener Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Sequence[Ai
Gateway Mcp Server Passthrough Listener Tool] - Per-tool access-control overrides for tools advertised by the remote MCP Server. Each
entry is matched to a remote tool by
name; only its access-control rules are applied. - updated_
at str - An ISO-8601 timestamp representation of entity update date.
- access Property Map
- config Property Map
- Routing, logging, and server configuration for the MCP Server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores List<Property Map>
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- rate
Limiting Property Map Rate limits applied to requests to this MCP Server, matched by MCP method or tool name. Each AI Gateway node counts and enforces the limits independently.
Requires a minimum runtime version of
2.3.- token
Vault Property Map Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools List<Property Map>
- Per-tool access-control overrides for tools advertised by the remote MCP Server. Each
entry is matched to a remote tool by
name; only its access-control rules are applied. - updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayMcpServerPassthroughListenerAccess, AiGatewayMcpServerPassthroughListenerAccessArgs
- Consumer
Ai
Gateway Mcp Server Passthrough Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Oauth
Access AiToken Gateway Mcp Server Passthrough Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Consumer
Ai
Gateway Mcp Server Passthrough Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- Oauth
Access AiToken Gateway Mcp Server Passthrough Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer object
- Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth_
access_ objecttoken - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Passthrough Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access AiToken Gateway Mcp Server Passthrough Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Passthrough Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access AiToken Gateway Mcp Server Passthrough Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer
Ai
Gateway Mcp Server Passthrough Listener Access Consumer - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth_
access_ Aitoken Gateway Mcp Server Passthrough Listener Access Oauth Access Token - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- consumer Property Map
- Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
- oauth
Access Property MapToken - Auth strategy and OAuth 2.0 Protected Resource Metadata configuration for granting access to an MCP server.
AiGatewayMcpServerPassthroughListenerAccessConsumer, AiGatewayMcpServerPassthroughListenerAccessConsumerArgs
- Acls
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies List<string> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers List<string> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- Acls
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies []string - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers []string - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls object
- Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies list(string) - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ objectacls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers list(string) - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata object
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies string[] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers string[] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Acls - Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies Sequence[str] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ Aiacls Gateway Mcp Server Passthrough Listener Access Consumer Default Tool Acls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers Sequence[str] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Passthrough Listener Access Consumer Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- acls Property Map
- Server-level access control rules for allowing or denying consumer groups. This is the
top-level gate: a caller's consumer group must pass this check before any MCP protocol
operation (
initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool Property MapAcls - Default per-tool access control rules for allowing or denying consumer groups access to
tools. Evaluated only for callers that already passed the server-level
aclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata Property Map
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
AiGatewayMcpServerPassthroughListenerAccessConsumerAcls, AiGatewayMcpServerPassthroughListenerAccessConsumerAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
AiGatewayMcpServerPassthroughListenerAccessConsumerDefaultToolAcls, AiGatewayMcpServerPassthroughListenerAccessConsumerDefaultToolAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerPassthroughListenerAccessConsumerMetadata, AiGatewayMcpServerPassthroughListenerAccessConsumerMetadataArgs
- List<string>
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds List<string> - List of OAuth scopes supported by the protected resource.
- []string
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds []string - List of OAuth scopes supported by the protected resource.
- list(string)
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes_
supporteds list(string) - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
- string[]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes
Supporteds string[] - List of OAuth scopes supported by the protected resource.
- Sequence[str]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint str - The authorization server metadata discovery URL.
- endpoint str
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource str
- The protected resource's identifier (resource URI).
- scopes_
supporteds Sequence[str] - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
AiGatewayMcpServerPassthroughListenerAccessOauthAccessToken, AiGatewayMcpServerPassthroughListenerAccessOauthAccessTokenArgs
- Access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - Acls
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies List<string> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers List<string> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- Access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - Acls
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - Auth
Strategies []string - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- Default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - Identity
Providers []string - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- Metadata
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access_
token_ stringclaim_ field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls object
- Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies list(string) - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ objectacls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers list(string) - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata object
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token StringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token stringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies string[] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool AiAcls Gateway Mcp Server Passthrough Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers string[] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access_
token_ strclaim_ field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Acls - Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth_
strategies Sequence[str] - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default_
tool_ Aiacls Gateway Mcp Server Passthrough Listener Access Oauth Access Token Default Tool Acls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity_
providers Sequence[str] - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata
Ai
Gateway Mcp Server Passthrough Listener Access Oauth Access Token Metadata - OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
- access
Token StringClaim Field - The claim in the OAuth2 access token to use as the subject for ACL evaluation when
acl_attribute_typeis set tooauth_access_token. Nested claim can be fetched by using a jq filter starts with dot, e.g., “.user.email”: https://jqlang.org/manual/#object-identifier-index Not Null - acls Property Map
- Server-level access control rules for allowing or denying callers, evaluated against the
value of the configured
access_token_claim_field. This is the top-level gate: a caller must pass this check before any MCP protocol operation (initialize,tools/list,tools/call) is allowed, and before any tool-leveldefault_tool_aclsor per-toolaccess.aclscheck is evaluated. - auth
Strategies List<String> - List of auth strategies for granting access to the MCP server. At most 1 auth strategy of each auth strategy type can be referenced.
- default
Tool Property MapAcls - Default per-tool access control rules for allowing or denying callers access to tools,
evaluated against the value of the configured
access_token_claim_field. Evaluated only for callers that already passed the server-levelaclscheck above. Applies to every tool exposed by this MCP Server unless a specific tool overrides it via that tool's ownaccess.acls. - identity
Providers List<String> - List of identity providers for granting access to the MCP server. At most 1 identity provider of each identity provider type can be referenced.
- metadata Property Map
- OAuth 2.0 Protected Resource Metadata advertised for this MCP server.
AiGatewayMcpServerPassthroughListenerAccessOauthAccessTokenAcls, AiGatewayMcpServerPassthroughListenerAccessOauthAccessTokenAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> - Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
AiGatewayMcpServerPassthroughListenerAccessOauthAccessTokenDefaultToolAcls, AiGatewayMcpServerPassthroughListenerAccessOauthAccessTokenDefaultToolAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerPassthroughListenerAccessOauthAccessTokenMetadata, AiGatewayMcpServerPassthroughListenerAccessOauthAccessTokenMetadataArgs
- List<string>
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds List<string> - List of OAuth scopes supported by the protected resource.
- []string
- List of authorization server issuer URLs that can issue tokens for this resource.
- Discovery
Endpoint string - The authorization server metadata discovery URL.
- Endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- Resource string
- The protected resource's identifier (resource URI).
- Scopes
Supporteds []string - List of OAuth scopes supported by the protected resource.
- list(string)
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes_
supporteds list(string) - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
- string[]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint string - The authorization server metadata discovery URL.
- endpoint string
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource string
- The protected resource's identifier (resource URI).
- scopes
Supporteds string[] - List of OAuth scopes supported by the protected resource.
- Sequence[str]
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery_
endpoint str - The authorization server metadata discovery URL.
- endpoint str
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource str
- The protected resource's identifier (resource URI).
- scopes_
supporteds Sequence[str] - List of OAuth scopes supported by the protected resource.
- List<String>
- List of authorization server issuer URLs that can issue tokens for this resource.
- discovery
Endpoint String - The authorization server metadata discovery URL.
- endpoint String
- The URL path where the OAuth 2.0 Protected Resource Metadata is served.
- resource String
- The protected resource's identifier (resource URI).
- scopes
Supporteds List<String> - List of OAuth scopes supported by the protected resource.
AiGatewayMcpServerPassthroughListenerConfig, AiGatewayMcpServerPassthroughListenerConfigArgs
- Ca
Certificates List<string> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - Certificates List<string>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Passthrough Listener Config Logging - Configuration for AI Gateway logging.
- Max
Request doubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Proxy
Ai
Gateway Mcp Server Passthrough Listener Config Proxy - HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider.
- Route
Ai
Gateway Mcp Server Passthrough Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Passthrough Listener Config Server - Server-side configuration for the MCP Server.
- Upstream
Ai
Gateway Mcp Server Passthrough Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- Ca
Certificates []string - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - Certificates []string
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Passthrough Listener Config Logging - Configuration for AI Gateway logging.
- Max
Request float64Body Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Proxy
Ai
Gateway Mcp Server Passthrough Listener Config Proxy - HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider.
- Route
Ai
Gateway Mcp Server Passthrough Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Passthrough Listener Config Server - Server-side configuration for the MCP Server.
- Upstream
Ai
Gateway Mcp Server Passthrough Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca_
certificates list(string) - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates list(string)
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging object
- Configuration for AI Gateway logging.
- max_
request_ numberbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- proxy object
- HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider.
- route object
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server object
- Server-side configuration for the MCP Server.
- upstream object
- Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates List<String> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Passthrough Listener Config Logging - Configuration for AI Gateway logging.
- max
Request DoubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- proxy
Ai
Gateway Mcp Server Passthrough Listener Config Proxy - HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider.
- route
Ai
Gateway Mcp Server Passthrough Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Passthrough Listener Config Server - Server-side configuration for the MCP Server.
- upstream
Ai
Gateway Mcp Server Passthrough Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates string[] - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates string[]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Passthrough Listener Config Logging - Configuration for AI Gateway logging.
- max
Request numberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- proxy
Ai
Gateway Mcp Server Passthrough Listener Config Proxy - HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider.
- route
Ai
Gateway Mcp Server Passthrough Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Passthrough Listener Config Server - Server-side configuration for the MCP Server.
- upstream
Ai
Gateway Mcp Server Passthrough Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca_
certificates Sequence[str] - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates Sequence[str]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Passthrough Listener Config Logging - Configuration for AI Gateway logging.
- max_
request_ floatbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- proxy
Ai
Gateway Mcp Server Passthrough Listener Config Proxy - HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider.
- route
Ai
Gateway Mcp Server Passthrough Listener Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Passthrough Listener Config Server - Server-side configuration for the MCP Server.
- upstream
Ai
Gateway Mcp Server Passthrough Listener Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url str
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates List<String> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging Property Map
- Configuration for AI Gateway logging.
- max
Request NumberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- proxy Property Map
- HTTP/HTTPS proxy configuration for outbound requests to the upstream AI provider.
- route Property Map
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server Property Map
- Server-side configuration for the MCP Server.
- upstream Property Map
- Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
AiGatewayMcpServerPassthroughListenerConfigLogging, AiGatewayMcpServerPassthroughListenerConfigLoggingArgs
AiGatewayMcpServerPassthroughListenerConfigProxy, AiGatewayMcpServerPassthroughListenerConfigProxyArgs
- Auth
Ai
Gateway Mcp Server Passthrough Listener Config Proxy Auth - Credentials used to authenticate to the proxy server.
- Http
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Http Proxy - HTTP proxy server to route plaintext outbound requests through.
- Https
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Https Proxy - HTTPS proxy server to route TLS outbound requests through.
- No
Proxy string - Comma-separated list of hosts that should not be proxied.
- Proxy
Scheme string - The proxy scheme to use when connecting to the proxy server. Default: "http"; must be "http"
- Auth
Ai
Gateway Mcp Server Passthrough Listener Config Proxy Auth - Credentials used to authenticate to the proxy server.
- Http
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Http Proxy - HTTP proxy server to route plaintext outbound requests through.
- Https
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Https Proxy - HTTPS proxy server to route TLS outbound requests through.
- No
Proxy string - Comma-separated list of hosts that should not be proxied.
- Proxy
Scheme string - The proxy scheme to use when connecting to the proxy server. Default: "http"; must be "http"
- auth object
- Credentials used to authenticate to the proxy server.
- http_
proxy object - HTTP proxy server to route plaintext outbound requests through.
- https_
proxy object - HTTPS proxy server to route TLS outbound requests through.
- no_
proxy string - Comma-separated list of hosts that should not be proxied.
- proxy_
scheme string - The proxy scheme to use when connecting to the proxy server. Default: "http"; must be "http"
- auth
Ai
Gateway Mcp Server Passthrough Listener Config Proxy Auth - Credentials used to authenticate to the proxy server.
- http
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Http Proxy - HTTP proxy server to route plaintext outbound requests through.
- https
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Https Proxy - HTTPS proxy server to route TLS outbound requests through.
- no
Proxy String - Comma-separated list of hosts that should not be proxied.
- proxy
Scheme String - The proxy scheme to use when connecting to the proxy server. Default: "http"; must be "http"
- auth
Ai
Gateway Mcp Server Passthrough Listener Config Proxy Auth - Credentials used to authenticate to the proxy server.
- http
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Http Proxy - HTTP proxy server to route plaintext outbound requests through.
- https
Proxy AiGateway Mcp Server Passthrough Listener Config Proxy Https Proxy - HTTPS proxy server to route TLS outbound requests through.
- no
Proxy string - Comma-separated list of hosts that should not be proxied.
- proxy
Scheme string - The proxy scheme to use when connecting to the proxy server. Default: "http"; must be "http"
- auth
Ai
Gateway Mcp Server Passthrough Listener Config Proxy Auth - Credentials used to authenticate to the proxy server.
- http_
proxy AiGateway Mcp Server Passthrough Listener Config Proxy Http Proxy - HTTP proxy server to route plaintext outbound requests through.
- https_
proxy AiGateway Mcp Server Passthrough Listener Config Proxy Https Proxy - HTTPS proxy server to route TLS outbound requests through.
- no_
proxy str - Comma-separated list of hosts that should not be proxied.
- proxy_
scheme str - The proxy scheme to use when connecting to the proxy server. Default: "http"; must be "http"
- auth Property Map
- Credentials used to authenticate to the proxy server.
- http
Proxy Property Map - HTTP proxy server to route plaintext outbound requests through.
- https
Proxy Property Map - HTTPS proxy server to route TLS outbound requests through.
- no
Proxy String - Comma-separated list of hosts that should not be proxied.
- proxy
Scheme String - The proxy scheme to use when connecting to the proxy server. Default: "http"; must be "http"
AiGatewayMcpServerPassthroughListenerConfigProxyAuth, AiGatewayMcpServerPassthroughListenerConfigProxyAuthArgs
- Password string
- The password to use for proxy authentication. This field is referenceable.
- Username string
- The username to use for proxy authentication. This field is referenceable.
- Password string
- The password to use for proxy authentication. This field is referenceable.
- Username string
- The username to use for proxy authentication. This field is referenceable.
- password string
- The password to use for proxy authentication. This field is referenceable.
- username string
- The username to use for proxy authentication. This field is referenceable.
- password String
- The password to use for proxy authentication. This field is referenceable.
- username String
- The username to use for proxy authentication. This field is referenceable.
- password string
- The password to use for proxy authentication. This field is referenceable.
- username string
- The username to use for proxy authentication. This field is referenceable.
- password str
- The password to use for proxy authentication. This field is referenceable.
- username str
- The username to use for proxy authentication. This field is referenceable.
- password String
- The password to use for proxy authentication. This field is referenceable.
- username String
- The username to use for proxy authentication. This field is referenceable.
AiGatewayMcpServerPassthroughListenerConfigProxyHttpProxy, AiGatewayMcpServerPassthroughListenerConfigProxyHttpProxyArgs
AiGatewayMcpServerPassthroughListenerConfigProxyHttpsProxy, AiGatewayMcpServerPassthroughListenerConfigProxyHttpsProxyArgs
AiGatewayMcpServerPassthroughListenerConfigRoute, AiGatewayMcpServerPassthroughListenerConfigRouteArgs
- Headers Dictionary<string, string>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts List<string>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect doubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods List<string>
- A list of HTTP methods that match this route.
- Paths List<string>
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols List<string>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<string>
- An optional set of strings associated with the route for grouping and filtering.
- Headers map[string]string
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts []string
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect float64Status Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods []string
- A list of HTTP methods that match this route.
- Paths []string
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols []string
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority float64 - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - []string
- An optional set of strings associated with the route for grouping and filtering.
- headers map(string)
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts list(string)
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ numberstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods list(string)
- A list of HTTP methods that match this route.
- paths list(string)
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols list(string)
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - list(string)
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String,String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect DoubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
- headers {[key: string]: string}
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts string[]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect numberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods string[]
- A list of HTTP methods that match this route.
- paths string[]
- A list of paths that match this route.
- preserve
Host boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols string[]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - string[]
- An optional set of strings associated with the route for grouping and filtering.
- headers Mapping[str, str]
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts Sequence[str]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ floatstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods Sequence[str]
- A list of HTTP methods that match this route.
- paths Sequence[str]
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols Sequence[str]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority float - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - Sequence[str]
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect NumberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
AiGatewayMcpServerPassthroughListenerConfigServer, AiGatewayMcpServerPassthroughListenerConfigServerArgs
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Session
Ai
Gateway Mcp Server Passthrough Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout double
- The timeout for calling the tools in milliseconds. Default: 10000
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Session
Ai
Gateway Mcp Server Passthrough Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout float64
- The timeout for calling the tools in milliseconds. Default: 10000
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session object
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Passthrough Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Double
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client booleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Passthrough Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session
Ai
Gateway Mcp Server Passthrough Listener Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout float
- The timeout for calling the tools in milliseconds. Default: 10000
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- session Property Map
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Number
- The timeout for calling the tools in milliseconds. Default: 10000
AiGatewayMcpServerPassthroughListenerConfigServerSession, AiGatewayMcpServerPassthroughListenerConfigServerSessionArgs
- Client
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl double - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- Client
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl float64 - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client object
- The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis object
- Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Client - The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Double - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Client - The configuration for client-side session storage.
- managed boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Client - The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl float - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy str
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client Property Map
- The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
AiGatewayMcpServerPassthroughListenerConfigServerSessionClient, AiGatewayMcpServerPassthroughListenerConfigServerSessionClientArgs
- Secrets List<string>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- Secrets []string
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets list(string)
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets string[]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets Sequence[str]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedis, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisArgs
- Cloud
Authentication AiGateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthentication, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAws, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAzure, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationGcp, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisCluster, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterNode, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisClusterNodeArgs
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisKeepalive, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinel, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Passthrough Listener Config Server Session Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelNode, AiGatewayMcpServerPassthroughListenerConfigServerSessionRedisSentinelNodeArgs
AiGatewayMcpServerPassthroughListenerConfigUpstream, AiGatewayMcpServerPassthroughListenerConfigUpstreamArgs
- Auth
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- Auth
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth Property Map
- Authentication to use when proxying to the upstream service.
AiGatewayMcpServerPassthroughListenerConfigUpstreamAuth, AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthArgs
- Aws
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- Aws
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Passthrough Listener Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws Property Map
- AWS IAM (SigV4) authentication for the upstream service.
AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthAws, AiGatewayMcpServerPassthroughListenerConfigUpstreamAuthAwsArgs
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ stringid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ stringurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ strid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region str
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token str - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ strurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
AiGatewayMcpServerPassthroughListenerDatastore, AiGatewayMcpServerPassthroughListenerDatastoreArgs
- Name string
- An immutable user-defined identifier for this resource. Not Null
- Name string
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name str
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
AiGatewayMcpServerPassthroughListenerRateLimiting, AiGatewayMcpServerPassthroughListenerRateLimitingArgs
- Limits
List<Ai
Gateway Mcp Server Passthrough Listener Rate Limiting Limit> - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- Limits
[]Ai
Gateway Mcp Server Passthrough Listener Rate Limiting Limit - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits list(object)
- The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits
List<Ai
Gateway Mcp Server Passthrough Listener Rate Limiting Limit> - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits
Ai
Gateway Mcp Server Passthrough Listener Rate Limiting Limit[] - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits
Sequence[Ai
Gateway Mcp Server Passthrough Listener Rate Limiting Limit] - The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
- limits List<Property Map>
- The rate limits to enforce. Each entry targets exactly one of
methodortool. Two entries cannot share the same target andwindow_size. Not Null
AiGatewayMcpServerPassthroughListenerRateLimitingLimit, AiGatewayMcpServerPassthroughListenerRateLimitingLimitArgs
- Limit double
- The number of requests allowed per window. Not Null
- Method string
- The MCP method this limit applies to.
- Tool string
- The name of the tool this limit applies to.
- Window
Size double - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- Limit float64
- The number of requests allowed per window. Not Null
- Method string
- The MCP method this limit applies to.
- Tool string
- The name of the tool this limit applies to.
- Window
Size float64 - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit number
- The number of requests allowed per window. Not Null
- method string
- The MCP method this limit applies to.
- tool string
- The name of the tool this limit applies to.
- window_
size number - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit Double
- The number of requests allowed per window. Not Null
- method String
- The MCP method this limit applies to.
- tool String
- The name of the tool this limit applies to.
- window
Size Double - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit number
- The number of requests allowed per window. Not Null
- method string
- The MCP method this limit applies to.
- tool string
- The name of the tool this limit applies to.
- window
Size number - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit float
- The number of requests allowed per window. Not Null
- method str
- The MCP method this limit applies to.
- tool str
- The name of the tool this limit applies to.
- window_
size float - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
- limit Number
- The number of requests allowed per window. Not Null
- method String
- The MCP method this limit applies to.
- tool String
- The name of the tool this limit applies to.
- window
Size Number - The window size in seconds, one of a second, a minute, an hour, or a day. possible known values include one of [1, 60, 3600, 86400]; Not Null
AiGatewayMcpServerPassthroughListenerTokenVault, AiGatewayMcpServerPassthroughListenerTokenVaultArgs
- Cache
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Passthrough Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- Cache
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Passthrough Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache object
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential object
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage object
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ stringtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Passthrough Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Passthrough Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Passthrough Listener Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider str
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ strtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache Property Map
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential Property Map
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage Property Map
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
AiGatewayMcpServerPassthroughListenerTokenVaultCache, AiGatewayMcpServerPassthroughListenerTokenVaultCacheArgs
- Redis
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- Redis
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedis, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisArgs
- Cloud
Authentication AiGateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthentication, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationAws, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationAzure, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationGcp, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisCluster, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterNode, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisClusterNodeArgs
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisKeepalive, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinel, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Passthrough Listener Token Vault Cache Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelNode, AiGatewayMcpServerPassthroughListenerTokenVaultCacheRedisSentinelNodeArgs
AiGatewayMcpServerPassthroughListenerTokenVaultCredential, AiGatewayMcpServerPassthroughListenerTokenVaultCredentialArgs
AiGatewayMcpServerPassthroughListenerTokenVaultCredentialInbound, AiGatewayMcpServerPassthroughListenerTokenVaultCredentialInboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerPassthroughListenerTokenVaultCredentialOutbound, AiGatewayMcpServerPassthroughListenerTokenVaultCredentialOutboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerPassthroughListenerTokenVaultStorage, AiGatewayMcpServerPassthroughListenerTokenVaultStorageArgs
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
List<Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
[]Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage Key - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys list(object)
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys
List<Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys
Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage Key[] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version str - The version of the encryption key used to encrypt new tokens.
- directory str
- The name of the directory in which tokens are stored.
- keys
Sequence[Ai
Gateway Mcp Server Passthrough Listener Token Vault Storage Key] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys List<Property Map>
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
AiGatewayMcpServerPassthroughListenerTokenVaultStorageKey, AiGatewayMcpServerPassthroughListenerTokenVaultStorageKeyArgs
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key str
- A vault reference to the encryption key. A literal key value is rejected.
- version str
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
AiGatewayMcpServerPassthroughListenerTool, AiGatewayMcpServerPassthroughListenerToolArgs
- Access
Ai
Gateway Mcp Server Passthrough Listener Tool Access - Access-control rules for a tool. Not Null
- Name string
- Tool identifier used to match remote MCP Server tools for ACL enforcement. Not Null
- Access
Ai
Gateway Mcp Server Passthrough Listener Tool Access - Access-control rules for a tool. Not Null
- Name string
- Tool identifier used to match remote MCP Server tools for ACL enforcement. Not Null
- access
Ai
Gateway Mcp Server Passthrough Listener Tool Access - Access-control rules for a tool. Not Null
- name String
- Tool identifier used to match remote MCP Server tools for ACL enforcement. Not Null
- access
Ai
Gateway Mcp Server Passthrough Listener Tool Access - Access-control rules for a tool. Not Null
- name string
- Tool identifier used to match remote MCP Server tools for ACL enforcement. Not Null
- access
Ai
Gateway Mcp Server Passthrough Listener Tool Access - Access-control rules for a tool. Not Null
- name str
- Tool identifier used to match remote MCP Server tools for ACL enforcement. Not Null
- access Property Map
- Access-control rules for a tool. Not Null
- name String
- Tool identifier used to match remote MCP Server tools for ACL enforcement. Not Null
AiGatewayMcpServerPassthroughListenerToolAccess, AiGatewayMcpServerPassthroughListenerToolAccessArgs
- Acls
Ai
Gateway Mcp Server Passthrough Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- Acls
Ai
Gateway Mcp Server Passthrough Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Passthrough Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Passthrough Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Passthrough Listener Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls Property Map
- Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
AiGatewayMcpServerPassthroughListenerToolAccessAcls, AiGatewayMcpServerPassthroughListenerToolAccessAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerUpstreamServer, AiGatewayMcpServerUpstreamServerArgs
- Config
Ai
Gateway Mcp Server Upstream Server Config - Routing, logging, and server configuration for the MCP Server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
List<Ai
Gateway Mcp Server Upstream Server Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies List<string>
- List of policy references.
- Token
Vault AiGateway Mcp Server Upstream Server Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
List<Ai
Gateway Mcp Server Upstream Server Tool> - List of tools exposed by this MCP Server.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Mcp Server Upstream Server Config - Routing, logging, and server configuration for the MCP Server. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Datastores
[]Ai
Gateway Mcp Server Upstream Server Datastore - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - Display
Name string - The display name for the MCP Server.
- Enabled bool
- Whether the MCP Server is enabled.
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- Policies []string
- List of policy references.
- Token
Vault AiGateway Mcp Server Upstream Server Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- Tools
[]Ai
Gateway Mcp Server Upstream Server Tool - List of tools exposed by this MCP Server.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Routing, logging, and server configuration for the MCP Server. Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- datastores list(object)
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name string - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by map(string) - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies list(string)
- List of policy references.
- token_
vault object Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools list(object)
- List of tools exposed by this MCP Server.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Mcp Server Upstream Server Config - Routing, logging, and server configuration for the MCP Server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores
List<Ai
Gateway Mcp Server Upstream Server Datastore> - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- token
Vault AiGateway Mcp Server Upstream Server Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
List<Ai
Gateway Mcp Server Upstream Server Tool> - List of tools exposed by this MCP Server.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Mcp Server Upstream Server Config - Routing, logging, and server configuration for the MCP Server. Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- datastores
Ai
Gateway Mcp Server Upstream Server Datastore[] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name string - The display name for the MCP Server.
- enabled boolean
- Whether the MCP Server is enabled.
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies string[]
- List of policy references.
- token
Vault AiGateway Mcp Server Upstream Server Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Ai
Gateway Mcp Server Upstream Server Tool[] - List of tools exposed by this MCP Server.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Mcp Server Upstream Server Config - Routing, logging, and server configuration for the MCP Server. Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- datastores
Sequence[Ai
Gateway Mcp Server Upstream Server Datastore] - The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display_
name str - The display name for the MCP Server.
- enabled bool
- Whether the MCP Server is enabled.
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies Sequence[str]
- List of policy references.
- token_
vault AiGateway Mcp Server Upstream Server Token Vault Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools
Sequence[Ai
Gateway Mcp Server Upstream Server Tool] - List of tools exposed by this MCP Server.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Routing, logging, and server configuration for the MCP Server. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- datastores List<Property Map>
- The Token Vault Datastore holding this entity's credential storage: the directory credentials
are written to, and the encryption keys that seal them. Required when
token_vaultis set (on an auth strategy, when its credential manager is enabled), and the referenced Datastore must have typetoken-vault. Only one Datastore can be referenced. - display
Name String - The display name for the MCP Server.
- enabled Boolean
- Whether the MCP Server is enabled.
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
Public labels store information about an entity that can be used for filtering a list of objects.
Public labels are intended to store PUBLIC metadata.
Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
- managed
By Map<String> - name String
- A user-defined unique identifier for this MCP server, used as a stable human-readable reference. This value is immutable after creation.
- policies List<String>
- List of policy references.
- token
Vault Property Map Resolves an upstream credential per request via Kong's Token Vault instead of sending a static credential. The directory credentials live in, and the keys that encrypt them, come from the
token-vaultDatastore this entity references, and are returned read-only instorage.Callers must enroll with the configured Token Vault provider before the credential can be resolved. Until enrollment completes, an MCP Server serves virtual
authenticateandcheck_authentication_statustools that guide the caller through the enrollment flow.Requires a minimum runtime version of
2.3.- tools List<Property Map>
- List of tools exposed by this MCP Server.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayMcpServerUpstreamServerConfig, AiGatewayMcpServerUpstreamServerConfigArgs
- Ca
Certificates List<string> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - Certificates List<string>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Upstream Server Config Logging - Configuration for AI Gateway logging.
- Max
Request doubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Upstream Server Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Upstream Server Config Server - Server-side configuration specific to
upstream-servermode. - Tools
Cache doubleTtl Seconds - The time-to-live (TTL) for the upstream tools cache in seconds. Set to
0to refresh on every client call. Not Null - Upstream
Ai
Gateway Mcp Server Upstream Server Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- Ca
Certificates []string - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - Certificates []string
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- Logging
Ai
Gateway Mcp Server Upstream Server Config Logging - Configuration for AI Gateway logging.
- Max
Request float64Body Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- Route
Ai
Gateway Mcp Server Upstream Server Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - Server
Ai
Gateway Mcp Server Upstream Server Config Server - Server-side configuration specific to
upstream-servermode. - Tools
Cache float64Ttl Seconds - The time-to-live (TTL) for the upstream tools cache in seconds. Set to
0to refresh on every client call. Not Null - Upstream
Ai
Gateway Mcp Server Upstream Server Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- Url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca_
certificates list(string) - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates list(string)
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging object
- Configuration for AI Gateway logging.
- max_
request_ numberbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route object
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server object
- Server-side configuration specific to
upstream-servermode. - tools_
cache_ numberttl_ seconds - The time-to-live (TTL) for the upstream tools cache in seconds. Set to
0to refresh on every client call. Not Null - upstream object
- Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates List<String> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Upstream Server Config Logging - Configuration for AI Gateway logging.
- max
Request DoubleBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Upstream Server Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Upstream Server Config Server - Server-side configuration specific to
upstream-servermode. - tools
Cache DoubleTtl Seconds - The time-to-live (TTL) for the upstream tools cache in seconds. Set to
0to refresh on every client call. Not Null - upstream
Ai
Gateway Mcp Server Upstream Server Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates string[] - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates string[]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Upstream Server Config Logging - Configuration for AI Gateway logging.
- max
Request numberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Upstream Server Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Upstream Server Config Server - Server-side configuration specific to
upstream-servermode. - tools
Cache numberTtl Seconds - The time-to-live (TTL) for the upstream tools cache in seconds. Set to
0to refresh on every client call. Not Null - upstream
Ai
Gateway Mcp Server Upstream Server Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url string
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca_
certificates Sequence[str] - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates Sequence[str]
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging
Ai
Gateway Mcp Server Upstream Server Config Logging - Configuration for AI Gateway logging.
- max_
request_ floatbody_ size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route
Ai
Gateway Mcp Server Upstream Server Config Route - Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server
Ai
Gateway Mcp Server Upstream Server Config Server - Server-side configuration specific to
upstream-servermode. - tools_
cache_ floatttl_ seconds - The time-to-live (TTL) for the upstream tools cache in seconds. Set to
0to refresh on every client call. Not Null - upstream
Ai
Gateway Mcp Server Upstream Server Config Upstream - Configuration applied when proxying to the upstream service, including authentication.
- url str
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
- ca
Certificates List<String> - CA certificates used to verify the TLS certificate of the upstream MCP server, referenced by
name. Each entry must be the
nameof an existing AI CA Certificate on the same AI Gateway. - certificates List<String>
Client certificates used for mutual TLS (mTLS) authentication with the upstream MCP server, referenced by name. Each entry must be the
nameof an existing AI Certificate on the same AI Gateway.The certificates are applied to the Kong Gateway Service generated for this MCP Server, which proxies requests to the upstream MCP server. The generated Service presents a single client certificate (
client_certificate) during the TLS handshake with the upstream, so at most one certificate may be configured.If unset, no client certificate is presented to the upstream.
- logging Property Map
- Configuration for AI Gateway logging.
- max
Request NumberBody Size - Maximum size of request body to parse. Set to 0 for unlimited. Default: 8388608
- route Property Map
- Route configuration for an MCP Server that terminates its own listener. At least one
of
hosts,paths,methods, orheadersmust be set so the route can match incoming requests. - server Property Map
- Server-side configuration specific to
upstream-servermode. - tools
Cache NumberTtl Seconds - The time-to-live (TTL) for the upstream tools cache in seconds. Set to
0to refresh on every client call. Not Null - upstream Property Map
- Configuration applied when proxying to the upstream service, including authentication.
- url String
- Helper field to set protocol, host, port and path of the upstream service using a URL. This is the same as a Kong Gateway Service URL: ${scheme}://${host}:${port}/${path} Not Null
AiGatewayMcpServerUpstreamServerConfigLogging, AiGatewayMcpServerUpstreamServerConfigLoggingArgs
AiGatewayMcpServerUpstreamServerConfigRoute, AiGatewayMcpServerUpstreamServerConfigRouteArgs
- Headers Dictionary<string, string>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts List<string>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect doubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods List<string>
- A list of HTTP methods that match this route.
- Paths List<string>
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols List<string>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<string>
- An optional set of strings associated with the route for grouping and filtering.
- Headers map[string]string
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - Hosts []string
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- Https
Redirect float64Status Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - Methods []string
- A list of HTTP methods that match this route.
- Paths []string
- A list of paths that match this route.
- Preserve
Host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - Protocols []string
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - Regex
Priority float64 - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - Request
Buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- Response
Buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- Strip
Path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - []string
- An optional set of strings associated with the route for grouping and filtering.
- headers map(string)
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts list(string)
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ numberstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods list(string)
- A list of HTTP methods that match this route.
- paths list(string)
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols list(string)
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - list(string)
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String,String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect DoubleStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Double - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
- headers {[key: string]: string}
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts string[]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect numberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods string[]
- A list of HTTP methods that match this route.
- paths string[]
- A list of paths that match this route.
- preserve
Host boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols string[]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - string[]
- An optional set of strings associated with the route for grouping and filtering.
- headers Mapping[str, str]
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts Sequence[str]
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https_
redirect_ floatstatus_ code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods Sequence[str]
- A list of HTTP methods that match this route.
- paths Sequence[str]
- A list of paths that match this route.
- preserve_
host bool - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols Sequence[str]
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex_
priority float - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request_
buffering bool - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response_
buffering bool - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip_
path bool - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - Sequence[str]
- An optional set of strings associated with the route for grouping and filtering.
- headers Map<String>
- One or more lists of values indexed by header name that will cause this route to match if present in the request. The
Hostheader cannot be used with this attribute: hosts should be specified using thehostsattribute. Whenheaderscontains only one value and that value starts with the special prefix~*, the value is interpreted as a regular expression. - hosts List<String>
- A list of domain names that match this route. Note that the hosts value is case sensitive.
- https
Redirect NumberStatus Code - The status code Kong responds with when all properties of a route match except the protocol i.e. if the protocol of the request is
HTTPinstead ofHTTPS.Locationheader is injected by Kong if the field is set to 301, 302, 307 or 308. Note: This config applies only if the route is configured to only accept thehttpsprotocol. Default: 426 - methods List<String>
- A list of HTTP methods that match this route.
- paths List<String>
- A list of paths that match this route.
- preserve
Host Boolean - When matching a route via one of the
hostsdomain names, use the requestHostheader in the upstream request headers. If set tofalse, the upstreamHostheader will be that of the service'shost. Default: false - protocols List<String>
- An array of the protocols this route should allow. See the route Object section for a list of accepted protocols. When set to only
https, HTTP requests are answered with an upgrade error. When set to onlyhttp, HTTPS requests are answered with an error. Default: ["http","https"] - regex
Priority Number - A number used to choose which route resolves a given request when several routes match it using regexes simultaneously. When two routes match the path and have the same
regex_priority, the older one (lowestcreated_at) is used. Note that the priority for non-regex routes is different (longer non-regex routes are matched before shorter ones). Default: 0 - request
Buffering Boolean - Whether to enable request body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that receive data with chunked transfer encoding. Default: true
- response
Buffering Boolean - Whether to enable response body buffering or not. With HTTP 1.1, it may make sense to turn this off on services that send data with chunked transfer encoding. Default: true
- strip
Path Boolean - When matching a route via one of the
paths, strip the matching prefix from the upstream request URL. Default: true - List<String>
- An optional set of strings associated with the route for grouping and filtering.
AiGatewayMcpServerUpstreamServerConfigServer, AiGatewayMcpServerUpstreamServerConfigServerArgs
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Preserve
Upstream boolTool Names - If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server.
If disabled (
false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. Default: false - Session
Ai
Gateway Mcp Server Upstream Server Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout double
- The timeout for calling the tools in milliseconds. Default: 10000
- Tools
List AiAuth Gateway Mcp Server Upstream Server Config Server Tools List Auth - Configuration for an Upstream Server's MCP Server Tools' Authentication.
- Upstream
Protocol stringVersion - The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to
negotiate a handshake revision with an
initializeexchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session.
- Forward
Client boolHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- Preserve
Upstream boolTool Names - If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server.
If disabled (
false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. Default: false - Session
Ai
Gateway Mcp Server Upstream Server Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- Timeout float64
- The timeout for calling the tools in milliseconds. Default: 10000
- Tools
List AiAuth Gateway Mcp Server Upstream Server Config Server Tools List Auth - Configuration for an Upstream Server's MCP Server Tools' Authentication.
- Upstream
Protocol stringVersion - The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to
negotiate a handshake revision with an
initializeexchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session.
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- preserve_
upstream_ booltool_ names - If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server.
If disabled (
false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. Default: false - session object
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- tools_
list_ objectauth - Configuration for an Upstream Server's MCP Server Tools' Authentication.
- upstream_
protocol_ stringversion - The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to
negotiate a handshake revision with an
initializeexchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session.
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- preserve
Upstream BooleanTool Names - If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server.
If disabled (
false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. Default: false - session
Ai
Gateway Mcp Server Upstream Server Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Double
- The timeout for calling the tools in milliseconds. Default: 10000
- tools
List AiAuth Gateway Mcp Server Upstream Server Config Server Tools List Auth - Configuration for an Upstream Server's MCP Server Tools' Authentication.
- upstream
Protocol StringVersion - The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to
negotiate a handshake revision with an
initializeexchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session.
- forward
Client booleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- preserve
Upstream booleanTool Names - If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server.
If disabled (
false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. Default: false - session
Ai
Gateway Mcp Server Upstream Server Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout number
- The timeout for calling the tools in milliseconds. Default: 10000
- tools
List AiAuth Gateway Mcp Server Upstream Server Config Server Tools List Auth - Configuration for an Upstream Server's MCP Server Tools' Authentication.
- upstream
Protocol stringVersion - The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to
negotiate a handshake revision with an
initializeexchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session.
- forward_
client_ boolheaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- preserve_
upstream_ booltool_ names - If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server.
If disabled (
false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. Default: false - session
Ai
Gateway Mcp Server Upstream Server Config Server Session - Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout float
- The timeout for calling the tools in milliseconds. Default: 10000
- tools_
list_ Aiauth Gateway Mcp Server Upstream Server Config Server Tools List Auth - Configuration for an Upstream Server's MCP Server Tools' Authentication.
- upstream_
protocol_ strversion - The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to
negotiate a handshake revision with an
initializeexchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session.
- forward
Client BooleanHeaders - Whether to forward the client request headers to the upstream server when calling the tools. Default: true
- preserve
Upstream BooleanTool Names - If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server.
If disabled (
false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used. Default: false - session Property Map
- Enable managed session when Kong responds as MCP server in listener, conversion-listener, or upstream-server modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers.
- timeout Number
- The timeout for calling the tools in milliseconds. Default: 10000
- tools
List Property MapAuth - Configuration for an Upstream Server's MCP Server Tools' Authentication.
- upstream
Protocol StringVersion - The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to
negotiate a handshake revision with an
initializeexchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session.
AiGatewayMcpServerUpstreamServerConfigServerSession, AiGatewayMcpServerUpstreamServerConfigServerSessionArgs
- Client
Ai
Gateway Mcp Server Upstream Server Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl double - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- Client
Ai
Gateway Mcp Server Upstream Server Config Server Session Client - The configuration for client-side session storage.
- Managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- Redis
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- Session
Ttl float64 - The time-to-live (TTL) for each session in seconds. Default: 86400
- Strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client object
- The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis object
- Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Upstream Server Config Server Session Client - The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Double - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Upstream Server Config Server Session Client - The configuration for client-side session storage.
- managed boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy string
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client
Ai
Gateway Mcp Server Upstream Server Config Server Session Client - The configuration for client-side session storage.
- managed bool
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis - Config for connecting to a Cloud Provider's Redis instance.
- session_
ttl float - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy str
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
- client Property Map
- The configuration for client-side session storage.
- managed Boolean
- If enabled, Kong will maintain managed sessions with the MCP server. Default: true
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
- session
Ttl Number - The time-to-live (TTL) for each session in seconds. Default: 86400
- strategy String
- The strategy for the session. If the value is 'client', the session is encrypted into MCP session id assigned to the client. If the value is not 'client', the session is stored in the configured database. possible known values include one of ["client", "redis"]
AiGatewayMcpServerUpstreamServerConfigServerSessionClient, AiGatewayMcpServerUpstreamServerConfigServerSessionClientArgs
- Secrets List<string>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- Secrets []string
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets list(string)
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets string[]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets Sequence[str]
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
- secrets List<String>
- The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedis, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisArgs
- Cloud
Authentication AiGateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthentication, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationAws, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationAzure, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationGcp, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisCluster, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterNode, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisClusterNodeArgs
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisKeepalive, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinel, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Upstream Server Config Server Session Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelNode, AiGatewayMcpServerUpstreamServerConfigServerSessionRedisSentinelNodeArgs
AiGatewayMcpServerUpstreamServerConfigServerToolsListAuth, AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthArgs
AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthCredentials, AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthCredentialsArgs
- Access
Token stringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- Client
Id string - The client ID for the OAuth 2.0 client-credentials. This field is referenceable. Not Null
- Client
Secret string - The client secret for the OAuth 2.0 client-credentials. This field is referenceable.
- Id
Token stringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- Scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- Token
Endpoint string - The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is referenceable. Not Null
- Access
Token stringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- Client
Id string - The client ID for the OAuth 2.0 client-credentials. This field is referenceable. Not Null
- Client
Secret string - The client secret for the OAuth 2.0 client-credentials. This field is referenceable.
- Id
Token stringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- Scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- Token
Endpoint string - The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is referenceable. Not Null
- access_
token_ stringheader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- client_
id string - The client ID for the OAuth 2.0 client-credentials. This field is referenceable. Not Null
- client_
secret string - The client secret for the OAuth 2.0 client-credentials. This field is referenceable.
- id_
token_ stringheader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- token_
endpoint string - The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is referenceable. Not Null
- access
Token StringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- client
Id String - The client ID for the OAuth 2.0 client-credentials. This field is referenceable. Not Null
- client
Secret String - The client secret for the OAuth 2.0 client-credentials. This field is referenceable.
- id
Token StringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope String
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- token
Endpoint String - The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is referenceable. Not Null
- access
Token stringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- client
Id string - The client ID for the OAuth 2.0 client-credentials. This field is referenceable. Not Null
- client
Secret string - The client secret for the OAuth 2.0 client-credentials. This field is referenceable.
- id
Token stringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- token
Endpoint string - The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is referenceable. Not Null
- access_
token_ strheader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- client_
id str - The client ID for the OAuth 2.0 client-credentials. This field is referenceable. Not Null
- client_
secret str - The client secret for the OAuth 2.0 client-credentials. This field is referenceable.
- id_
token_ strheader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope str
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- token_
endpoint str - The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is referenceable. Not Null
- access
Token StringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- client
Id String - The client ID for the OAuth 2.0 client-credentials. This field is referenceable. Not Null
- client
Secret String - The client secret for the OAuth 2.0 client-credentials. This field is referenceable.
- id
Token StringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope String
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- token
Endpoint String - The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials. This field is referenceable. Not Null
AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthJwt, AiGatewayMcpServerUpstreamServerConfigServerToolsListAuthJwtArgs
- Access
Token stringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- Id
Token stringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- Scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- Access
Token stringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- Id
Token stringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- Scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- access_
token_ stringheader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- id_
token_ stringheader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- access
Token StringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- id
Token StringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope String
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- access
Token stringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- id
Token stringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope string
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- access_
token_ strheader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- id_
token_ strheader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope str
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
- access
Token StringHeader - Header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Default: "Authorization"
- id
Token StringHeader - Header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave empty to omit the ID token when fetching the tools list.
- scope String
- The scopes for the OAuth 2.0 client-credentials. This field is referenceable.
AiGatewayMcpServerUpstreamServerConfigUpstream, AiGatewayMcpServerUpstreamServerConfigUpstreamArgs
- Auth
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth - Authentication to use when proxying to the upstream service.
- Auth
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth - Authentication to use when proxying to the upstream service.
- auth Property Map
- Authentication to use when proxying to the upstream service.
AiGatewayMcpServerUpstreamServerConfigUpstreamAuth, AiGatewayMcpServerUpstreamServerConfigUpstreamAuthArgs
- Aws
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- Aws
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws
Ai
Gateway Mcp Server Upstream Server Config Upstream Auth Aws - AWS IAM (SigV4) authentication for the upstream service.
- aws Property Map
- AWS IAM (SigV4) authentication for the upstream service.
AiGatewayMcpServerUpstreamServerConfigUpstreamAuthAws, AiGatewayMcpServerUpstreamServerConfigUpstreamAuthAwsArgs
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- Access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- Region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- Session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- Sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ stringid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ stringurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key stringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region string
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token string - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint stringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access_
key_ strid - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region str
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session_
token str - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts_
endpoint_ strurl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
- access
Key StringId - The access key id for authenticating with static IAM User credentials. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating authentication tokens. This field is referenceable.
- region String
- The AWS region of the upstream service. Overrides the region inferred from the environment.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - The secret access key for authenticating with static IAM User credentials. This field is referenceable.
- session
Token String - The session token for authenticating with temporary IAM credentials. This field is referenceable.
- sts
Endpoint StringUrl - The STS endpoint URL to use for generating authentication tokens. If not specified, the default AWS STS endpoint will be used.
AiGatewayMcpServerUpstreamServerDatastore, AiGatewayMcpServerUpstreamServerDatastoreArgs
- Name string
- An immutable user-defined identifier for this resource. Not Null
- Name string
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
- name string
- An immutable user-defined identifier for this resource. Not Null
- name str
- An immutable user-defined identifier for this resource. Not Null
- name String
- An immutable user-defined identifier for this resource. Not Null
AiGatewayMcpServerUpstreamServerTokenVault, AiGatewayMcpServerUpstreamServerTokenVaultArgs
- Cache
Ai
Gateway Mcp Server Upstream Server Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Upstream Server Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Upstream Server Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- Cache
Ai
Gateway Mcp Server Upstream Server Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- Credential
Ai
Gateway Mcp Server Upstream Server Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- Provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- Storage
Ai
Gateway Mcp Server Upstream Server Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - Subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache object
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential object
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage object
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ stringtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Upstream Server Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Upstream Server Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Upstream Server Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Upstream Server Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Upstream Server Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider string
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Upstream Server Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token stringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache
Ai
Gateway Mcp Server Upstream Server Token Vault Cache - Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential
Ai
Gateway Mcp Server Upstream Server Token Vault Credential - Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider str
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage
Ai
Gateway Mcp Server Upstream Server Token Vault Storage - Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject_
token_ strtype - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
- cache Property Map
- Optional best-effort cache for exchanged credentials, shared across the cluster. Losing it only costs a re-exchange. Credentials are encrypted with the keys held by the Token Vault Datastore before being cached.
- credential Property Map
- Where the caller's subject token is read from, and where the credential the Token Vault returns is placed on the upstream request.
- provider String
- Name of the upstream credential provider registered in the Token Vault directory. Not Null
- storage Property Map
- Read-only. The directory and encryption key versions this entity's credentials are stored
with, resolved from the
token-vaultDatastore referenced indatastores; change them on the Datastore. - subject
Token StringType - The kind of bearer token the caller presents, which the Token Vault exchanges for the
upstream credential. Omit it unless the request shape makes the token type ambiguous: it is
otherwise resolved from the request, and failing that from the token's shape (a JWS is an
access_token, anything else anapi_key). possible known values include one of ["access_token", "api_key"]
AiGatewayMcpServerUpstreamServerTokenVaultCache, AiGatewayMcpServerUpstreamServerTokenVaultCacheArgs
- Redis
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- Redis
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis - Config for connecting to a Cloud Provider's Redis instance.
- redis Property Map
- Config for connecting to a Cloud Provider's Redis instance.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedis, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisArgs
- Cloud
Authentication AiGateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- Cloud
Authentication AiGateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- Cluster
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- Keepalive
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- Server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication object - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster object
- Cluster configuration for the Redis connection.
- connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive object
- Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel object
- Configuration for Redis Sentinel.
- server_
name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication AiGateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port string
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server
Name string - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud_
authentication AiGateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster - Cluster configuration for the Redis connection.
- connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Keepalive - Keepalive configuration for the Redis connection.
- password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port str
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel - Configuration for Redis Sentinel.
- server_
name str - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: true
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
- cloud
Authentication Property Map - Auth related config for connecting to a Cloud Provider's Redis instance.
- cluster Property Map
- Cluster configuration for the Redis connection.
- connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. This field is referenceable. Default: "127.0.0.1"
- keepalive Property Map
- Keepalive configuration for the Redis connection.
- password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis. This field is referenceable.
- port String
- An integer representing a port number between 0 and 65535, inclusive. This field is referenceable. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel Property Map
- Configuration for Redis Sentinel.
- server
Name String - A string representing an SNI (server name indication) value for TLS. This field is referenceable.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: true
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default. This field is referenceable.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthentication, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationArgs
- Aws
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- Aws
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- Azure
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- Gcp
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Aws - AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Azure - Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cloud Authentication Gcp - GCP specific configs for connecting to a Cloud Provider's redis instance.
- aws Property Map
- AWS specific configs for connecting to a Cloud Provider's redis instance.
- azure Property Map
- Azure specific configs for connecting to a Cloud Provider's redis instance.
- gcp Property Map
- GCP specific configs for connecting to a Cloud Provider's redis instance.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationAws, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationAwsArgs
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- Access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- Assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- Cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- Is
Serverless bool - This flag specifies whether the cluster is serverless. Default: true
- Region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- Role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- Secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ stringid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ stringarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ stringname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ stringkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
- access
Key stringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role stringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name string - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless boolean - This flag specifies whether the cluster is serverless. Default: true
- region string
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session stringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access stringKey - AWS Secret Access Key. This field is referenceable.
- access_
key_ strid - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume_
role_ strarn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache_
name str - The name of the AWS Elasticache cluster. This field is referenceable.
- is_
serverless bool - This flag specifies whether the cluster is serverless. Default: true
- region str
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role_
session_ strname - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret_
access_ strkey - AWS Secret Access Key. This field is referenceable.
- access
Key StringId - AWS Access Key ID to be used for authentication. This field is referenceable.
- assume
Role StringArn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens. This field is referenceable.
- cache
Name String - The name of the AWS Elasticache cluster. This field is referenceable.
- is
Serverless Boolean - This flag specifies whether the cluster is serverless. Default: true
- region String
- The region of the AWS ElastiCache cluster. This field is referenceable.
- role
Session StringName - The session name for the temporary credentials when assuming the IAM role. This field is referenceable.
- secret
Access StringKey - AWS Secret Access Key. This field is referenceable.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationAzure, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationAzureArgs
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- Client
Id string - Azure Client ID. This field is referenceable.
- Client
Secret string - Azure Client Secret. This field is referenceable.
- Tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id string - Azure Client ID. This field is referenceable.
- client_
secret string - Azure Client Secret. This field is referenceable.
- tenant_
id string - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
- client
Id string - Azure Client ID. This field is referenceable.
- client
Secret string - Azure Client Secret. This field is referenceable.
- tenant
Id string - Azure Tenant ID. This field is referenceable.
- client_
id str - Azure Client ID. This field is referenceable.
- client_
secret str - Azure Client Secret. This field is referenceable.
- tenant_
id str - Azure Tenant ID. This field is referenceable.
- client
Id String - Azure Client ID. This field is referenceable.
- client
Secret String - Azure Client Secret. This field is referenceable.
- tenant
Id String - Azure Tenant ID. This field is referenceable.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationGcp, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCloudAuthenticationGcpArgs
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- Service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ stringjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
- service
Account stringJson - GCP Service Account JSON. This field is referenceable.
- service_
account_ strjson - GCP Service Account JSON. This field is referenceable.
- service
Account StringJson - GCP Service Account JSON. This field is referenceable.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisCluster, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterArgs
- Max
Redirections double - Maximum retry attempts for redirection. Default: 5
- Nodes
List<Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- Max
Redirections float64 - Maximum retry attempts for redirection. Default: 5
- Nodes
[]Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections number - Maximum retry attempts for redirection. Default: 5
- nodes list(object)
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Double - Maximum retry attempts for redirection. Default: 5
- nodes
List<Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections number - Maximum retry attempts for redirection. Default: 5
- nodes
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max_
redirections float - Maximum retry attempts for redirection. Default: 5
- nodes
Sequence[Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
- max
Redirections Number - Maximum retry attempts for redirection. Default: 5
- nodes List<Property Map>
- Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterNode, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisClusterNodeArgs
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisKeepalive, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisKeepaliveArgs
- Backlog double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- Backlog float64
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - Pool
Size float64 - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Double
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Double - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog float
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool_
size float - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
- backlog Number
- Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thanpool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thanpool_size. - pool
Size Number - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
pool_sizenorbacklogis specified, no pool is created. Ifpool_sizeisn't specified butbacklogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinel, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelArgs
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
List<Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- Master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Nodes
[]Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- Role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes list(object)
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
List<Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master string
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password string
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role string
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username string
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master str
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes
Sequence[Ai
Gateway Mcp Server Upstream Server Token Vault Cache Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password str
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role str
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username str
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
- master String
- Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- nodes List<Property Map>
- Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - password String
- Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels. This field is referenceable.
- role String
- Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - username String
- Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+. This field is referenceable.
AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelNode, AiGatewayMcpServerUpstreamServerTokenVaultCacheRedisSentinelNodeArgs
AiGatewayMcpServerUpstreamServerTokenVaultCredential, AiGatewayMcpServerUpstreamServerTokenVaultCredentialArgs
AiGatewayMcpServerUpstreamServerTokenVaultCredentialInbound, AiGatewayMcpServerUpstreamServerTokenVaultCredentialInboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerUpstreamServerTokenVaultCredentialOutbound, AiGatewayMcpServerUpstreamServerTokenVaultCredentialOutboundArgs
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- Location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - Name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - Prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location string
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name string
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix string
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location str
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name str
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix str
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
- location String
- Whether the credential travels in a header, the request body, or the query string. Defaults to
header. possible known values include one of ["header", "body", "query"] - name String
- Name of the header, query parameter, or body field carrying the credential. Defaults to
Authorizationfor a header,access_tokenotherwise. - prefix String
- String prepended verbatim to the credential value. Defaults to
Bearer(with its trailing space) for a header, and to no prefix otherwise. Set it to an empty string when the provider expects the raw credential.
AiGatewayMcpServerUpstreamServerTokenVaultStorage, AiGatewayMcpServerUpstreamServerTokenVaultStorageArgs
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
List<Ai
Gateway Mcp Server Upstream Server Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- Current
Version string - The version of the encryption key used to encrypt new tokens.
- Directory string
- The name of the directory in which tokens are stored.
- Keys
[]Ai
Gateway Mcp Server Upstream Server Token Vault Storage Key - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys list(object)
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys
List<Ai
Gateway Mcp Server Upstream Server Token Vault Storage Key> - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version string - The version of the encryption key used to encrypt new tokens.
- directory string
- The name of the directory in which tokens are stored.
- keys
Ai
Gateway Mcp Server Upstream Server Token Vault Storage Key[] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current_
version str - The version of the encryption key used to encrypt new tokens.
- directory str
- The name of the directory in which tokens are stored.
- keys
Sequence[Ai
Gateway Mcp Server Upstream Server Token Vault Storage Key] - The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
- current
Version String - The version of the encryption key used to encrypt new tokens.
- directory String
- The name of the directory in which tokens are stored.
- keys List<Property Map>
- The encryption keys used to protect stored tokens. Keep previous versions in the list so existing tokens can still be decrypted.
AiGatewayMcpServerUpstreamServerTokenVaultStorageKey, AiGatewayMcpServerUpstreamServerTokenVaultStorageKeyArgs
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- Key string
- A vault reference to the encryption key. A literal key value is rejected.
- Version string
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
- key string
- A vault reference to the encryption key. A literal key value is rejected.
- version string
- The identifier of this key version.
- key str
- A vault reference to the encryption key. A literal key value is rejected.
- version str
- The identifier of this key version.
- key String
- A vault reference to the encryption key. A literal key value is rejected.
- version String
- The identifier of this key version.
AiGatewayMcpServerUpstreamServerTool, AiGatewayMcpServerUpstreamServerToolArgs
- Access
Ai
Gateway Mcp Server Upstream Server Tool Access - Access-control rules for a tool.
- Annotations
Ai
Gateway Mcp Server Upstream Server Tool Annotations - Description string
- A description of what the tool does.
- Input
Schema string - The entire
inputSchemasection for the tool. Overrides the upstream server'sinputSchemafor the same tool name, if present. Parsed as JSON. - Name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- Output
Schema string - The entire
outputSchemasection for the tool. Overrides the upstream server'soutputSchemafor the same tool name, if present. Parsed as JSON.
- Access
Ai
Gateway Mcp Server Upstream Server Tool Access - Access-control rules for a tool.
- Annotations
Ai
Gateway Mcp Server Upstream Server Tool Annotations - Description string
- A description of what the tool does.
- Input
Schema string - The entire
inputSchemasection for the tool. Overrides the upstream server'sinputSchemafor the same tool name, if present. Parsed as JSON. - Name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- Output
Schema string - The entire
outputSchemasection for the tool. Overrides the upstream server'soutputSchemafor the same tool name, if present. Parsed as JSON.
- access object
- Access-control rules for a tool.
- annotations object
- description string
- A description of what the tool does.
- input_
schema string - The entire
inputSchemasection for the tool. Overrides the upstream server'sinputSchemafor the same tool name, if present. Parsed as JSON. - name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- output_
schema string - The entire
outputSchemasection for the tool. Overrides the upstream server'soutputSchemafor the same tool name, if present. Parsed as JSON.
- access
Ai
Gateway Mcp Server Upstream Server Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Upstream Server Tool Annotations - description String
- A description of what the tool does.
- input
Schema String - The entire
inputSchemasection for the tool. Overrides the upstream server'sinputSchemafor the same tool name, if present. Parsed as JSON. - name String
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- output
Schema String - The entire
outputSchemasection for the tool. Overrides the upstream server'soutputSchemafor the same tool name, if present. Parsed as JSON.
- access
Ai
Gateway Mcp Server Upstream Server Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Upstream Server Tool Annotations - description string
- A description of what the tool does.
- input
Schema string - The entire
inputSchemasection for the tool. Overrides the upstream server'sinputSchemafor the same tool name, if present. Parsed as JSON. - name string
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- output
Schema string - The entire
outputSchemasection for the tool. Overrides the upstream server'soutputSchemafor the same tool name, if present. Parsed as JSON.
- access
Ai
Gateway Mcp Server Upstream Server Tool Access - Access-control rules for a tool.
- annotations
Ai
Gateway Mcp Server Upstream Server Tool Annotations - description str
- A description of what the tool does.
- input_
schema str - The entire
inputSchemasection for the tool. Overrides the upstream server'sinputSchemafor the same tool name, if present. Parsed as JSON. - name str
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- output_
schema str - The entire
outputSchemasection for the tool. Overrides the upstream server'soutputSchemafor the same tool name, if present. Parsed as JSON.
- access Property Map
- Access-control rules for a tool.
- annotations Property Map
- description String
- A description of what the tool does.
- input
Schema String - The entire
inputSchemasection for the tool. Overrides the upstream server'sinputSchemafor the same tool name, if present. Parsed as JSON. - name String
- The MCP tool name. In upstream-server mode, it also matches the remote MCP Server tool whose metadata this entry overrides. Not Null
- output
Schema String - The entire
outputSchemasection for the tool. Overrides the upstream server'soutputSchemafor the same tool name, if present. Parsed as JSON.
AiGatewayMcpServerUpstreamServerToolAccess, AiGatewayMcpServerUpstreamServerToolAccessArgs
- Acls
Ai
Gateway Mcp Server Upstream Server Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- Acls
Ai
Gateway Mcp Server Upstream Server Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Upstream Server Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Upstream Server Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls
Ai
Gateway Mcp Server Upstream Server Tool Access Acls - Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
- acls Property Map
- Access control rules for allowing or denying consumer groups access to this tool. When configured, these will override the default access control rules defined on the MCP Server.
AiGatewayMcpServerUpstreamServerToolAccessAcls, AiGatewayMcpServerUpstreamServerToolAccessAclsArgs
- Allow
Whens List<string> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows List<string>
- List of consumer groups that are permitted access.
- Denies List<string>
- List of consumer groups that are denied access.
- Deny
Whens List<string> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- Allow
Whens []string - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- Allows []string
- List of consumer groups that are permitted access.
- Denies []string
- List of consumer groups that are denied access.
- Deny
Whens []string Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens list(string) - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows list(string)
- List of consumer groups that are permitted access.
- denies list(string)
- List of consumer groups that are denied access.
- deny_
whens list(string) Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens string[] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows string[]
- List of consumer groups that are permitted access.
- denies string[]
- List of consumer groups that are denied access.
- deny
Whens string[] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow_
whens Sequence[str] - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows Sequence[str]
- List of consumer groups that are permitted access.
- denies Sequence[str]
- List of consumer groups that are denied access.
- deny_
whens Sequence[str] Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
- allow
Whens List<String> - Allow the request if it matches any of these CEL boolean expressions evaluated against the request context.
- allows List<String>
- List of consumer groups that are permitted access.
- denies List<String>
- List of consumer groups that are denied access.
- deny
Whens List<String> Deny the request if it matches any of these CEL boolean expressions evaluated against the request context.
Requires a minimum runtime version of
2.3.
AiGatewayMcpServerUpstreamServerToolAnnotations, AiGatewayMcpServerUpstreamServerToolAnnotationsArgs
- Destructive
Hint bool - If true, the tool may perform destructive updates
- Idempotent
Hint bool - If true, repeated calls with same args have no additional effect
- Open
World boolHint - If true, tool interacts with external entities
- Read
Only boolHint - If true, the tool does not modify its environment
- Title string
- Human-readable title for the tool
- Destructive
Hint bool - If true, the tool may perform destructive updates
- Idempotent
Hint bool - If true, repeated calls with same args have no additional effect
- Open
World boolHint - If true, tool interacts with external entities
- Read
Only boolHint - If true, the tool does not modify its environment
- Title string
- Human-readable title for the tool
- destructive_
hint bool - If true, the tool may perform destructive updates
- idempotent_
hint bool - If true, repeated calls with same args have no additional effect
- open_
world_ boolhint - If true, tool interacts with external entities
- read_
only_ boolhint - If true, the tool does not modify its environment
- title string
- Human-readable title for the tool
- destructive
Hint Boolean - If true, the tool may perform destructive updates
- idempotent
Hint Boolean - If true, repeated calls with same args have no additional effect
- open
World BooleanHint - If true, tool interacts with external entities
- read
Only BooleanHint - If true, the tool does not modify its environment
- title String
- Human-readable title for the tool
- destructive
Hint boolean - If true, the tool may perform destructive updates
- idempotent
Hint boolean - If true, repeated calls with same args have no additional effect
- open
World booleanHint - If true, tool interacts with external entities
- read
Only booleanHint - If true, the tool does not modify its environment
- title string
- Human-readable title for the tool
- destructive_
hint bool - If true, the tool may perform destructive updates
- idempotent_
hint bool - If true, repeated calls with same args have no additional effect
- open_
world_ boolhint - If true, tool interacts with external entities
- read_
only_ boolhint - If true, the tool does not modify its environment
- title str
- Human-readable title for the tool
- destructive
Hint Boolean - If true, the tool may perform destructive updates
- idempotent
Hint Boolean - If true, repeated calls with same args have no additional effect
- open
World BooleanHint - If true, tool interacts with external entities
- read
Only BooleanHint - If true, the tool does not modify its environment
- title String
- Human-readable title for the tool
Import
In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:
terraform
import {
to = konnect_ai_gateway_mcp_server.my_konnect_ai_gateway_mcp_server
id = jsonencode({
gateway_id = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
id = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
})
}
The pulumi import command can be used, for example:
$ pulumi import konnect:index/aiGatewayMcpServer:AiGatewayMcpServer my_konnect_ai_gateway_mcp_server '{"gateway_id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7", "id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"}'
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- konnect kong/terraform-provider-konnect
- License
- Notes
- This Pulumi package is based on the
konnectTerraform Provider.
published on Friday, Nov 6, 2026 by kong