1. Packages
  2. Konnect Provider
  3. API Docs
  4. GatewayPluginAiMcpOauth2
konnect 3.4.1 published on Wednesday, Oct 29, 2025 by kong

konnect.GatewayPluginAiMcpOauth2

Get Started
konnect logo
konnect 3.4.1 published on Wednesday, Oct 29, 2025 by kong

    GatewayPluginAiMcpOauth2 Resource

    Example Usage

    Example coming soon!
    
    Example coming soon!
    
    Example coming soon!
    
    Example coming soon!
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.konnect.GatewayPluginAiMcpOauth2;
    import com.pulumi.konnect.GatewayPluginAiMcpOauth2Args;
    import com.pulumi.konnect.inputs.GatewayPluginAiMcpOauth2ConfigArgs;
    import com.pulumi.konnect.inputs.GatewayPluginAiMcpOauth2OrderingArgs;
    import com.pulumi.konnect.inputs.GatewayPluginAiMcpOauth2OrderingAfterArgs;
    import com.pulumi.konnect.inputs.GatewayPluginAiMcpOauth2OrderingBeforeArgs;
    import com.pulumi.konnect.inputs.GatewayPluginAiMcpOauth2PartialArgs;
    import com.pulumi.konnect.inputs.GatewayPluginAiMcpOauth2RouteArgs;
    import com.pulumi.konnect.inputs.GatewayPluginAiMcpOauth2ServiceArgs;
    import static com.pulumi.codegen.internal.Serialization.*;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var myGatewaypluginaimcpoauth2 = new GatewayPluginAiMcpOauth2("myGatewaypluginaimcpoauth2", GatewayPluginAiMcpOauth2Args.builder()
                .config(GatewayPluginAiMcpOauth2ConfigArgs.builder()
                    .args(Map.of("key", serializeJson(
                        "value")))
                    .authorization_servers("...")
                    .cache_introspection(false)
                    .claim_to_header(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                    .client_alg("HS384")
                    .client_auth("none")
                    .client_id("...my_client_id...")
                    .client_jwk("...my_client_jwk...")
                    .client_secret("...my_client_secret...")
                    .headers(Map.of("key", serializeJson(
                        "value")))
                    .http_proxy("...my_http_proxy...")
                    .http_proxy_authorization("...my_http_proxy_authorization...")
                    .http_version(9.95)
                    .https_proxy("...my_https_proxy...")
                    .https_proxy_authorization("...my_https_proxy_authorization...")
                    .insecure_relaxed_audience_validation(false)
                    .introspection_endpoint("...my_introspection_endpoint...")
                    .introspection_format("base64")
                    .keepalive(false)
                    .max_request_body_size(6)
                    .metadata_endpoint("...my_metadata_endpoint...")
                    .mtls_introspection_endpoint("...my_mtls_introspection_endpoint...")
                    .no_proxy("...my_no_proxy...")
                    .resource("...my_resource...")
                    .scopes_supported("...")
                    .ssl_verify(true)
                    .timeout(4.02)
                    .tls_client_auth_cert("...my_tls_client_auth_cert...")
                    .tls_client_auth_key("...my_tls_client_auth_key...")
                    .tls_client_auth_ssl_verify(false)
                    .build())
                .controlPlaneId("9524ec7d-36d9-465d-a8c5-83a3c9390458")
                .createdAt(6)
                .enabled(true)
                .gatewayPluginAiMcpOauth2Id("...my_id...")
                .instanceName("...my_instance_name...")
                .ordering(GatewayPluginAiMcpOauth2OrderingArgs.builder()
                    .after(GatewayPluginAiMcpOauth2OrderingAfterArgs.builder()
                        .access("...")
                        .build())
                    .before(GatewayPluginAiMcpOauth2OrderingBeforeArgs.builder()
                        .access("...")
                        .build())
                    .build())
                .partials(GatewayPluginAiMcpOauth2PartialArgs.builder()
                    .id("...my_id...")
                    .name("...my_name...")
                    .path("...my_path...")
                    .build())
                .protocols("grpc")
                .route(GatewayPluginAiMcpOauth2RouteArgs.builder()
                    .id("...my_id...")
                    .build())
                .service(GatewayPluginAiMcpOauth2ServiceArgs.builder()
                    .id("...my_id...")
                    .build())
                .tags("...")
                .updatedAt(4)
                .build());
    
        }
    }
    
    resources:
      myGatewaypluginaimcpoauth2:
        type: konnect:GatewayPluginAiMcpOauth2
        properties:
          config:
            args:
              key:
                fn::toJSON: value
            authorization_servers:
              - '...'
            cache_introspection: false
            claim_to_header:
              - claim: '...my_claim...'
                header: '...my_header...'
            client_alg: HS384
            client_auth: none
            client_id: '...my_client_id...'
            client_jwk: '...my_client_jwk...'
            client_secret: '...my_client_secret...'
            headers:
              key:
                fn::toJSON: value
            http_proxy: '...my_http_proxy...'
            http_proxy_authorization: '...my_http_proxy_authorization...'
            http_version: 9.95
            https_proxy: '...my_https_proxy...'
            https_proxy_authorization: '...my_https_proxy_authorization...'
            insecure_relaxed_audience_validation: false
            introspection_endpoint: '...my_introspection_endpoint...'
            introspection_format: base64
            keepalive: false
            max_request_body_size: 6
            metadata_endpoint: '...my_metadata_endpoint...'
            mtls_introspection_endpoint: '...my_mtls_introspection_endpoint...'
            no_proxy: '...my_no_proxy...'
            resource: '...my_resource...'
            scopes_supported:
              - '...'
            ssl_verify: true
            timeout: 4.02
            tls_client_auth_cert: '...my_tls_client_auth_cert...'
            tls_client_auth_key: '...my_tls_client_auth_key...'
            tls_client_auth_ssl_verify: false
          controlPlaneId: 9524ec7d-36d9-465d-a8c5-83a3c9390458
          createdAt: 6
          enabled: true
          gatewayPluginAiMcpOauth2Id: '...my_id...'
          instanceName: '...my_instance_name...'
          ordering:
            after:
              access:
                - '...'
            before:
              access:
                - '...'
          partials:
            - id: '...my_id...'
              name: '...my_name...'
              path: '...my_path...'
          protocols:
            - grpc
          route:
            id: '...my_id...'
          service:
            id: '...my_id...'
          tags:
            - '...'
          updatedAt: 4
    

    Create GatewayPluginAiMcpOauth2 Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GatewayPluginAiMcpOauth2(name: string, args: GatewayPluginAiMcpOauth2Args, opts?: CustomResourceOptions);
    @overload
    def GatewayPluginAiMcpOauth2(resource_name: str,
                                 args: GatewayPluginAiMcpOauth2Args,
                                 opts: Optional[ResourceOptions] = None)
    
    @overload
    def GatewayPluginAiMcpOauth2(resource_name: str,
                                 opts: Optional[ResourceOptions] = None,
                                 control_plane_id: Optional[str] = None,
                                 ordering: Optional[GatewayPluginAiMcpOauth2OrderingArgs] = None,
                                 created_at: Optional[float] = None,
                                 enabled: Optional[bool] = None,
                                 gateway_plugin_ai_mcp_oauth2_id: Optional[str] = None,
                                 instance_name: Optional[str] = None,
                                 config: Optional[GatewayPluginAiMcpOauth2ConfigArgs] = None,
                                 partials: Optional[Sequence[GatewayPluginAiMcpOauth2PartialArgs]] = None,
                                 protocols: Optional[Sequence[str]] = None,
                                 route: Optional[GatewayPluginAiMcpOauth2RouteArgs] = None,
                                 service: Optional[GatewayPluginAiMcpOauth2ServiceArgs] = None,
                                 tags: Optional[Sequence[str]] = None,
                                 updated_at: Optional[float] = None)
    func NewGatewayPluginAiMcpOauth2(ctx *Context, name string, args GatewayPluginAiMcpOauth2Args, opts ...ResourceOption) (*GatewayPluginAiMcpOauth2, error)
    public GatewayPluginAiMcpOauth2(string name, GatewayPluginAiMcpOauth2Args args, CustomResourceOptions? opts = null)
    public GatewayPluginAiMcpOauth2(String name, GatewayPluginAiMcpOauth2Args args)
    public GatewayPluginAiMcpOauth2(String name, GatewayPluginAiMcpOauth2Args args, CustomResourceOptions options)
    
    type: konnect:GatewayPluginAiMcpOauth2
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args GatewayPluginAiMcpOauth2Args
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GatewayPluginAiMcpOauth2Args
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GatewayPluginAiMcpOauth2Args
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GatewayPluginAiMcpOauth2Args
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GatewayPluginAiMcpOauth2Args
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var gatewayPluginAiMcpOauth2Resource = new Konnect.GatewayPluginAiMcpOauth2("gatewayPluginAiMcpOauth2Resource", new()
    {
        ControlPlaneId = "string",
        Ordering = new Konnect.Inputs.GatewayPluginAiMcpOauth2OrderingArgs
        {
            After = new Konnect.Inputs.GatewayPluginAiMcpOauth2OrderingAfterArgs
            {
                Accesses = new[]
                {
                    "string",
                },
            },
            Before = new Konnect.Inputs.GatewayPluginAiMcpOauth2OrderingBeforeArgs
            {
                Accesses = new[]
                {
                    "string",
                },
            },
        },
        CreatedAt = 0,
        Enabled = false,
        GatewayPluginAiMcpOauth2Id = "string",
        InstanceName = "string",
        Config = new Konnect.Inputs.GatewayPluginAiMcpOauth2ConfigArgs
        {
            ClientId = "string",
            AuthorizationServers = new[]
            {
                "string",
            },
            Resource = "string",
            IntrospectionEndpoint = "string",
            HttpsProxyAuthorization = "string",
            IntrospectionFormat = "string",
            ClientAlg = "string",
            ClientJwk = "string",
            ClientSecret = "string",
            Headers = 
            {
                { "string", "string" },
            },
            HttpProxy = "string",
            HttpProxyAuthorization = "string",
            HttpVersion = 0,
            HttpsProxy = "string",
            Args = 
            {
                { "string", "string" },
            },
            InsecureRelaxedAudienceValidation = false,
            ClaimToHeaders = new[]
            {
                new Konnect.Inputs.GatewayPluginAiMcpOauth2ConfigClaimToHeaderArgs
                {
                    Claim = "string",
                    Header = "string",
                },
            },
            ClientAuth = "string",
            Keepalive = false,
            MaxRequestBodySize = 0,
            MetadataEndpoint = "string",
            MtlsIntrospectionEndpoint = "string",
            NoProxy = "string",
            CacheIntrospection = false,
            ScopesSupporteds = new[]
            {
                "string",
            },
            SslVerify = false,
            Timeout = 0,
            TlsClientAuthCert = "string",
            TlsClientAuthKey = "string",
            TlsClientAuthSslVerify = false,
        },
        Partials = new[]
        {
            new Konnect.Inputs.GatewayPluginAiMcpOauth2PartialArgs
            {
                Id = "string",
                Name = "string",
                Path = "string",
            },
        },
        Protocols = new[]
        {
            "string",
        },
        Route = new Konnect.Inputs.GatewayPluginAiMcpOauth2RouteArgs
        {
            Id = "string",
        },
        Service = new Konnect.Inputs.GatewayPluginAiMcpOauth2ServiceArgs
        {
            Id = "string",
        },
        Tags = new[]
        {
            "string",
        },
        UpdatedAt = 0,
    });
    
    example, err := konnect.NewGatewayPluginAiMcpOauth2(ctx, "gatewayPluginAiMcpOauth2Resource", &konnect.GatewayPluginAiMcpOauth2Args{
    	ControlPlaneId: pulumi.String("string"),
    	Ordering: &konnect.GatewayPluginAiMcpOauth2OrderingArgs{
    		After: &konnect.GatewayPluginAiMcpOauth2OrderingAfterArgs{
    			Accesses: pulumi.StringArray{
    				pulumi.String("string"),
    			},
    		},
    		Before: &konnect.GatewayPluginAiMcpOauth2OrderingBeforeArgs{
    			Accesses: pulumi.StringArray{
    				pulumi.String("string"),
    			},
    		},
    	},
    	CreatedAt:                  pulumi.Float64(0),
    	Enabled:                    pulumi.Bool(false),
    	GatewayPluginAiMcpOauth2Id: pulumi.String("string"),
    	InstanceName:               pulumi.String("string"),
    	Config: &konnect.GatewayPluginAiMcpOauth2ConfigArgs{
    		ClientId: pulumi.String("string"),
    		AuthorizationServers: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		Resource:                pulumi.String("string"),
    		IntrospectionEndpoint:   pulumi.String("string"),
    		HttpsProxyAuthorization: pulumi.String("string"),
    		IntrospectionFormat:     pulumi.String("string"),
    		ClientAlg:               pulumi.String("string"),
    		ClientJwk:               pulumi.String("string"),
    		ClientSecret:            pulumi.String("string"),
    		Headers: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		HttpProxy:              pulumi.String("string"),
    		HttpProxyAuthorization: pulumi.String("string"),
    		HttpVersion:            pulumi.Float64(0),
    		HttpsProxy:             pulumi.String("string"),
    		Args: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		InsecureRelaxedAudienceValidation: pulumi.Bool(false),
    		ClaimToHeaders: konnect.GatewayPluginAiMcpOauth2ConfigClaimToHeaderArray{
    			&konnect.GatewayPluginAiMcpOauth2ConfigClaimToHeaderArgs{
    				Claim:  pulumi.String("string"),
    				Header: pulumi.String("string"),
    			},
    		},
    		ClientAuth:                pulumi.String("string"),
    		Keepalive:                 pulumi.Bool(false),
    		MaxRequestBodySize:        pulumi.Float64(0),
    		MetadataEndpoint:          pulumi.String("string"),
    		MtlsIntrospectionEndpoint: pulumi.String("string"),
    		NoProxy:                   pulumi.String("string"),
    		CacheIntrospection:        pulumi.Bool(false),
    		ScopesSupporteds: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		SslVerify:              pulumi.Bool(false),
    		Timeout:                pulumi.Float64(0),
    		TlsClientAuthCert:      pulumi.String("string"),
    		TlsClientAuthKey:       pulumi.String("string"),
    		TlsClientAuthSslVerify: pulumi.Bool(false),
    	},
    	Partials: konnect.GatewayPluginAiMcpOauth2PartialArray{
    		&konnect.GatewayPluginAiMcpOauth2PartialArgs{
    			Id:   pulumi.String("string"),
    			Name: pulumi.String("string"),
    			Path: pulumi.String("string"),
    		},
    	},
    	Protocols: pulumi.StringArray{
    		pulumi.String("string"),
    	},
    	Route: &konnect.GatewayPluginAiMcpOauth2RouteArgs{
    		Id: pulumi.String("string"),
    	},
    	Service: &konnect.GatewayPluginAiMcpOauth2ServiceArgs{
    		Id: pulumi.String("string"),
    	},
    	Tags: pulumi.StringArray{
    		pulumi.String("string"),
    	},
    	UpdatedAt: pulumi.Float64(0),
    })
    
    var gatewayPluginAiMcpOauth2Resource = new GatewayPluginAiMcpOauth2("gatewayPluginAiMcpOauth2Resource", GatewayPluginAiMcpOauth2Args.builder()
        .controlPlaneId("string")
        .ordering(GatewayPluginAiMcpOauth2OrderingArgs.builder()
            .after(GatewayPluginAiMcpOauth2OrderingAfterArgs.builder()
                .accesses("string")
                .build())
            .before(GatewayPluginAiMcpOauth2OrderingBeforeArgs.builder()
                .accesses("string")
                .build())
            .build())
        .createdAt(0.0)
        .enabled(false)
        .gatewayPluginAiMcpOauth2Id("string")
        .instanceName("string")
        .config(GatewayPluginAiMcpOauth2ConfigArgs.builder()
            .clientId("string")
            .authorizationServers("string")
            .resource("string")
            .introspectionEndpoint("string")
            .httpsProxyAuthorization("string")
            .introspectionFormat("string")
            .clientAlg("string")
            .clientJwk("string")
            .clientSecret("string")
            .headers(Map.of("string", "string"))
            .httpProxy("string")
            .httpProxyAuthorization("string")
            .httpVersion(0.0)
            .httpsProxy("string")
            .args(Map.of("string", "string"))
            .insecureRelaxedAudienceValidation(false)
            .claimToHeaders(GatewayPluginAiMcpOauth2ConfigClaimToHeaderArgs.builder()
                .claim("string")
                .header("string")
                .build())
            .clientAuth("string")
            .keepalive(false)
            .maxRequestBodySize(0.0)
            .metadataEndpoint("string")
            .mtlsIntrospectionEndpoint("string")
            .noProxy("string")
            .cacheIntrospection(false)
            .scopesSupporteds("string")
            .sslVerify(false)
            .timeout(0.0)
            .tlsClientAuthCert("string")
            .tlsClientAuthKey("string")
            .tlsClientAuthSslVerify(false)
            .build())
        .partials(GatewayPluginAiMcpOauth2PartialArgs.builder()
            .id("string")
            .name("string")
            .path("string")
            .build())
        .protocols("string")
        .route(GatewayPluginAiMcpOauth2RouteArgs.builder()
            .id("string")
            .build())
        .service(GatewayPluginAiMcpOauth2ServiceArgs.builder()
            .id("string")
            .build())
        .tags("string")
        .updatedAt(0.0)
        .build());
    
    gateway_plugin_ai_mcp_oauth2_resource = konnect.GatewayPluginAiMcpOauth2("gatewayPluginAiMcpOauth2Resource",
        control_plane_id="string",
        ordering={
            "after": {
                "accesses": ["string"],
            },
            "before": {
                "accesses": ["string"],
            },
        },
        created_at=0,
        enabled=False,
        gateway_plugin_ai_mcp_oauth2_id="string",
        instance_name="string",
        config={
            "client_id": "string",
            "authorization_servers": ["string"],
            "resource": "string",
            "introspection_endpoint": "string",
            "https_proxy_authorization": "string",
            "introspection_format": "string",
            "client_alg": "string",
            "client_jwk": "string",
            "client_secret": "string",
            "headers": {
                "string": "string",
            },
            "http_proxy": "string",
            "http_proxy_authorization": "string",
            "http_version": 0,
            "https_proxy": "string",
            "args": {
                "string": "string",
            },
            "insecure_relaxed_audience_validation": False,
            "claim_to_headers": [{
                "claim": "string",
                "header": "string",
            }],
            "client_auth": "string",
            "keepalive": False,
            "max_request_body_size": 0,
            "metadata_endpoint": "string",
            "mtls_introspection_endpoint": "string",
            "no_proxy": "string",
            "cache_introspection": False,
            "scopes_supporteds": ["string"],
            "ssl_verify": False,
            "timeout": 0,
            "tls_client_auth_cert": "string",
            "tls_client_auth_key": "string",
            "tls_client_auth_ssl_verify": False,
        },
        partials=[{
            "id": "string",
            "name": "string",
            "path": "string",
        }],
        protocols=["string"],
        route={
            "id": "string",
        },
        service={
            "id": "string",
        },
        tags=["string"],
        updated_at=0)
    
    const gatewayPluginAiMcpOauth2Resource = new konnect.GatewayPluginAiMcpOauth2("gatewayPluginAiMcpOauth2Resource", {
        controlPlaneId: "string",
        ordering: {
            after: {
                accesses: ["string"],
            },
            before: {
                accesses: ["string"],
            },
        },
        createdAt: 0,
        enabled: false,
        gatewayPluginAiMcpOauth2Id: "string",
        instanceName: "string",
        config: {
            clientId: "string",
            authorizationServers: ["string"],
            resource: "string",
            introspectionEndpoint: "string",
            httpsProxyAuthorization: "string",
            introspectionFormat: "string",
            clientAlg: "string",
            clientJwk: "string",
            clientSecret: "string",
            headers: {
                string: "string",
            },
            httpProxy: "string",
            httpProxyAuthorization: "string",
            httpVersion: 0,
            httpsProxy: "string",
            args: {
                string: "string",
            },
            insecureRelaxedAudienceValidation: false,
            claimToHeaders: [{
                claim: "string",
                header: "string",
            }],
            clientAuth: "string",
            keepalive: false,
            maxRequestBodySize: 0,
            metadataEndpoint: "string",
            mtlsIntrospectionEndpoint: "string",
            noProxy: "string",
            cacheIntrospection: false,
            scopesSupporteds: ["string"],
            sslVerify: false,
            timeout: 0,
            tlsClientAuthCert: "string",
            tlsClientAuthKey: "string",
            tlsClientAuthSslVerify: false,
        },
        partials: [{
            id: "string",
            name: "string",
            path: "string",
        }],
        protocols: ["string"],
        route: {
            id: "string",
        },
        service: {
            id: "string",
        },
        tags: ["string"],
        updatedAt: 0,
    });
    
    type: konnect:GatewayPluginAiMcpOauth2
    properties:
        config:
            args:
                string: string
            authorizationServers:
                - string
            cacheIntrospection: false
            claimToHeaders:
                - claim: string
                  header: string
            clientAlg: string
            clientAuth: string
            clientId: string
            clientJwk: string
            clientSecret: string
            headers:
                string: string
            httpProxy: string
            httpProxyAuthorization: string
            httpVersion: 0
            httpsProxy: string
            httpsProxyAuthorization: string
            insecureRelaxedAudienceValidation: false
            introspectionEndpoint: string
            introspectionFormat: string
            keepalive: false
            maxRequestBodySize: 0
            metadataEndpoint: string
            mtlsIntrospectionEndpoint: string
            noProxy: string
            resource: string
            scopesSupporteds:
                - string
            sslVerify: false
            timeout: 0
            tlsClientAuthCert: string
            tlsClientAuthKey: string
            tlsClientAuthSslVerify: false
        controlPlaneId: string
        createdAt: 0
        enabled: false
        gatewayPluginAiMcpOauth2Id: string
        instanceName: string
        ordering:
            after:
                accesses:
                    - string
            before:
                accesses:
                    - string
        partials:
            - id: string
              name: string
              path: string
        protocols:
            - string
        route:
            id: string
        service:
            id: string
        tags:
            - string
        updatedAt: 0
    

    GatewayPluginAiMcpOauth2 Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GatewayPluginAiMcpOauth2 resource accepts the following input properties:

    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    Config GatewayPluginAiMcpOauth2Config
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    CreatedAt double
    Unix epoch when the resource was created.
    Enabled bool
    Whether the plugin is applied. Default: true
    GatewayPluginAiMcpOauth2Id string
    A string representing a UUID (universally unique identifier).
    InstanceName string
    A unique string representing a UTF-8 encoded name.
    Ordering GatewayPluginAiMcpOauth2Ordering
    Partials List<GatewayPluginAiMcpOauth2Partial>
    A list of partials to be used by the plugin.
    Protocols List<string>
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    Route GatewayPluginAiMcpOauth2Route
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginAiMcpOauth2Service
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags List<string>
    An optional set of strings associated with the Plugin for grouping and filtering.
    UpdatedAt double
    Unix epoch when the resource was last updated.
    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    Config GatewayPluginAiMcpOauth2ConfigArgs
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    CreatedAt float64
    Unix epoch when the resource was created.
    Enabled bool
    Whether the plugin is applied. Default: true
    GatewayPluginAiMcpOauth2Id string
    A string representing a UUID (universally unique identifier).
    InstanceName string
    A unique string representing a UTF-8 encoded name.
    Ordering GatewayPluginAiMcpOauth2OrderingArgs
    Partials []GatewayPluginAiMcpOauth2PartialArgs
    A list of partials to be used by the plugin.
    Protocols []string
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    Route GatewayPluginAiMcpOauth2RouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginAiMcpOauth2ServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags []string
    An optional set of strings associated with the Plugin for grouping and filtering.
    UpdatedAt float64
    Unix epoch when the resource was last updated.
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    config GatewayPluginAiMcpOauth2Config
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    createdAt Double
    Unix epoch when the resource was created.
    enabled Boolean
    Whether the plugin is applied. Default: true
    gatewayPluginAiMcpOauth2Id String
    A string representing a UUID (universally unique identifier).
    instanceName String
    A unique string representing a UTF-8 encoded name.
    ordering GatewayPluginAiMcpOauth2Ordering
    partials List<GatewayPluginAiMcpOauth2Partial>
    A list of partials to be used by the plugin.
    protocols List<String>
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route GatewayPluginAiMcpOauth2Route
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginAiMcpOauth2Service
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt Double
    Unix epoch when the resource was last updated.
    controlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    config GatewayPluginAiMcpOauth2Config
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    createdAt number
    Unix epoch when the resource was created.
    enabled boolean
    Whether the plugin is applied. Default: true
    gatewayPluginAiMcpOauth2Id string
    A string representing a UUID (universally unique identifier).
    instanceName string
    A unique string representing a UTF-8 encoded name.
    ordering GatewayPluginAiMcpOauth2Ordering
    partials GatewayPluginAiMcpOauth2Partial[]
    A list of partials to be used by the plugin.
    protocols string[]
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route GatewayPluginAiMcpOauth2Route
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginAiMcpOauth2Service
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags string[]
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt number
    Unix epoch when the resource was last updated.
    control_plane_id str
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    config GatewayPluginAiMcpOauth2ConfigArgs
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    created_at float
    Unix epoch when the resource was created.
    enabled bool
    Whether the plugin is applied. Default: true
    gateway_plugin_ai_mcp_oauth2_id str
    A string representing a UUID (universally unique identifier).
    instance_name str
    A unique string representing a UTF-8 encoded name.
    ordering GatewayPluginAiMcpOauth2OrderingArgs
    partials Sequence[GatewayPluginAiMcpOauth2PartialArgs]
    A list of partials to be used by the plugin.
    protocols Sequence[str]
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route GatewayPluginAiMcpOauth2RouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginAiMcpOauth2ServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags Sequence[str]
    An optional set of strings associated with the Plugin for grouping and filtering.
    updated_at float
    Unix epoch when the resource was last updated.
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    config Property Map
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    createdAt Number
    Unix epoch when the resource was created.
    enabled Boolean
    Whether the plugin is applied. Default: true
    gatewayPluginAiMcpOauth2Id String
    A string representing a UUID (universally unique identifier).
    instanceName String
    A unique string representing a UTF-8 encoded name.
    ordering Property Map
    partials List<Property Map>
    A list of partials to be used by the plugin.
    protocols List<String>
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route Property Map
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service Property Map
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt Number
    Unix epoch when the resource was last updated.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GatewayPluginAiMcpOauth2 resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing GatewayPluginAiMcpOauth2 Resource

    Get an existing GatewayPluginAiMcpOauth2 resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GatewayPluginAiMcpOauth2State, opts?: CustomResourceOptions): GatewayPluginAiMcpOauth2
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            config: Optional[GatewayPluginAiMcpOauth2ConfigArgs] = None,
            control_plane_id: Optional[str] = None,
            created_at: Optional[float] = None,
            enabled: Optional[bool] = None,
            gateway_plugin_ai_mcp_oauth2_id: Optional[str] = None,
            instance_name: Optional[str] = None,
            ordering: Optional[GatewayPluginAiMcpOauth2OrderingArgs] = None,
            partials: Optional[Sequence[GatewayPluginAiMcpOauth2PartialArgs]] = None,
            protocols: Optional[Sequence[str]] = None,
            route: Optional[GatewayPluginAiMcpOauth2RouteArgs] = None,
            service: Optional[GatewayPluginAiMcpOauth2ServiceArgs] = None,
            tags: Optional[Sequence[str]] = None,
            updated_at: Optional[float] = None) -> GatewayPluginAiMcpOauth2
    func GetGatewayPluginAiMcpOauth2(ctx *Context, name string, id IDInput, state *GatewayPluginAiMcpOauth2State, opts ...ResourceOption) (*GatewayPluginAiMcpOauth2, error)
    public static GatewayPluginAiMcpOauth2 Get(string name, Input<string> id, GatewayPluginAiMcpOauth2State? state, CustomResourceOptions? opts = null)
    public static GatewayPluginAiMcpOauth2 get(String name, Output<String> id, GatewayPluginAiMcpOauth2State state, CustomResourceOptions options)
    resources:  _:    type: konnect:GatewayPluginAiMcpOauth2    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Config GatewayPluginAiMcpOauth2Config
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    CreatedAt double
    Unix epoch when the resource was created.
    Enabled bool
    Whether the plugin is applied. Default: true
    GatewayPluginAiMcpOauth2Id string
    A string representing a UUID (universally unique identifier).
    InstanceName string
    A unique string representing a UTF-8 encoded name.
    Ordering GatewayPluginAiMcpOauth2Ordering
    Partials List<GatewayPluginAiMcpOauth2Partial>
    A list of partials to be used by the plugin.
    Protocols List<string>
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    Route GatewayPluginAiMcpOauth2Route
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginAiMcpOauth2Service
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags List<string>
    An optional set of strings associated with the Plugin for grouping and filtering.
    UpdatedAt double
    Unix epoch when the resource was last updated.
    Config GatewayPluginAiMcpOauth2ConfigArgs
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    CreatedAt float64
    Unix epoch when the resource was created.
    Enabled bool
    Whether the plugin is applied. Default: true
    GatewayPluginAiMcpOauth2Id string
    A string representing a UUID (universally unique identifier).
    InstanceName string
    A unique string representing a UTF-8 encoded name.
    Ordering GatewayPluginAiMcpOauth2OrderingArgs
    Partials []GatewayPluginAiMcpOauth2PartialArgs
    A list of partials to be used by the plugin.
    Protocols []string
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    Route GatewayPluginAiMcpOauth2RouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginAiMcpOauth2ServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags []string
    An optional set of strings associated with the Plugin for grouping and filtering.
    UpdatedAt float64
    Unix epoch when the resource was last updated.
    config GatewayPluginAiMcpOauth2Config
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    createdAt Double
    Unix epoch when the resource was created.
    enabled Boolean
    Whether the plugin is applied. Default: true
    gatewayPluginAiMcpOauth2Id String
    A string representing a UUID (universally unique identifier).
    instanceName String
    A unique string representing a UTF-8 encoded name.
    ordering GatewayPluginAiMcpOauth2Ordering
    partials List<GatewayPluginAiMcpOauth2Partial>
    A list of partials to be used by the plugin.
    protocols List<String>
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route GatewayPluginAiMcpOauth2Route
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginAiMcpOauth2Service
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt Double
    Unix epoch when the resource was last updated.
    config GatewayPluginAiMcpOauth2Config
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    controlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    createdAt number
    Unix epoch when the resource was created.
    enabled boolean
    Whether the plugin is applied. Default: true
    gatewayPluginAiMcpOauth2Id string
    A string representing a UUID (universally unique identifier).
    instanceName string
    A unique string representing a UTF-8 encoded name.
    ordering GatewayPluginAiMcpOauth2Ordering
    partials GatewayPluginAiMcpOauth2Partial[]
    A list of partials to be used by the plugin.
    protocols string[]
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route GatewayPluginAiMcpOauth2Route
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginAiMcpOauth2Service
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags string[]
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt number
    Unix epoch when the resource was last updated.
    config GatewayPluginAiMcpOauth2ConfigArgs
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    control_plane_id str
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    created_at float
    Unix epoch when the resource was created.
    enabled bool
    Whether the plugin is applied. Default: true
    gateway_plugin_ai_mcp_oauth2_id str
    A string representing a UUID (universally unique identifier).
    instance_name str
    A unique string representing a UTF-8 encoded name.
    ordering GatewayPluginAiMcpOauth2OrderingArgs
    partials Sequence[GatewayPluginAiMcpOauth2PartialArgs]
    A list of partials to be used by the plugin.
    protocols Sequence[str]
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route GatewayPluginAiMcpOauth2RouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginAiMcpOauth2ServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags Sequence[str]
    An optional set of strings associated with the Plugin for grouping and filtering.
    updated_at float
    Unix epoch when the resource was last updated.
    config Property Map
    The configuration for MCP authorization in OAuth2. If this is enabled, make sure the configured metadata_endpoint is also covered by the same route so the authorization can be applied correctly.
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    createdAt Number
    Unix epoch when the resource was created.
    enabled Boolean
    Whether the plugin is applied. Default: true
    gatewayPluginAiMcpOauth2Id String
    A string representing a UUID (universally unique identifier).
    instanceName String
    A unique string representing a UTF-8 encoded name.
    ordering Property Map
    partials List<Property Map>
    A list of partials to be used by the plugin.
    protocols List<String>
    A set of strings representing HTTP protocols. Default: ["grpc","grpcs","http","https"]
    route Property Map
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service Property Map
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt Number
    Unix epoch when the resource was last updated.

    Supporting Types

    GatewayPluginAiMcpOauth2Config, GatewayPluginAiMcpOauth2ConfigArgs

    AuthorizationServers List<string>
    ClientId string
    The client ID for authentication.
    IntrospectionEndpoint string
    The introspection endpoint URL.
    Resource string
    The resource identifier.
    Args Dictionary<string, string>
    Additional arguments to send in the POST body.
    CacheIntrospection bool
    If enabled, the plugin will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server. Default: true
    ClaimToHeaders List<GatewayPluginAiMcpOauth2ConfigClaimToHeader>
    ClientAlg string
    The client JWT signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]
    ClientAuth string
    The client authentication method. must be one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"]
    ClientJwk string
    The client JWK for privatekeyjwt authentication.
    ClientSecret string
    The client secret for authentication.
    Headers Dictionary<string, string>
    Additional headers for the introspection request.
    HttpProxy string
    HTTP proxy to use.
    HttpProxyAuthorization string
    HTTP proxy authorization header.
    HttpVersion double
    The HTTP version used for requests.
    HttpsProxy string
    HTTPS proxy to use.
    HttpsProxyAuthorization string
    HTTPS proxy authorization header.
    InsecureRelaxedAudienceValidation bool
    If enabled, the plugin will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification. Default: false
    IntrospectionFormat string
    Controls introspection response format. must be one of ["base64", "base64url", "string"]
    Keepalive bool
    Enable HTTP keepalive for requests. Default: true
    MaxRequestBodySize double
    max allowed body size allowed to be handled as MCP request. Default: 8192
    MetadataEndpoint string
    The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource.
    MtlsIntrospectionEndpoint string
    The mTLS alias for the introspection endpoint.
    NoProxy string
    Comma-separated list of hosts to exclude from proxy.
    ScopesSupporteds List<string>
    SslVerify bool
    Verify the SSL certificate. Default: true
    Timeout double
    Network I/O timeout in milliseconds. Default: 10000
    TlsClientAuthCert string
    PEM-encoded client certificate for mTLS.
    TlsClientAuthKey string
    PEM-encoded private key for mTLS.
    TlsClientAuthSslVerify bool
    Verify server certificate in mTLS. Default: true
    AuthorizationServers []string
    ClientId string
    The client ID for authentication.
    IntrospectionEndpoint string
    The introspection endpoint URL.
    Resource string
    The resource identifier.
    Args map[string]string
    Additional arguments to send in the POST body.
    CacheIntrospection bool
    If enabled, the plugin will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server. Default: true
    ClaimToHeaders []GatewayPluginAiMcpOauth2ConfigClaimToHeader
    ClientAlg string
    The client JWT signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]
    ClientAuth string
    The client authentication method. must be one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"]
    ClientJwk string
    The client JWK for privatekeyjwt authentication.
    ClientSecret string
    The client secret for authentication.
    Headers map[string]string
    Additional headers for the introspection request.
    HttpProxy string
    HTTP proxy to use.
    HttpProxyAuthorization string
    HTTP proxy authorization header.
    HttpVersion float64
    The HTTP version used for requests.
    HttpsProxy string
    HTTPS proxy to use.
    HttpsProxyAuthorization string
    HTTPS proxy authorization header.
    InsecureRelaxedAudienceValidation bool
    If enabled, the plugin will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification. Default: false
    IntrospectionFormat string
    Controls introspection response format. must be one of ["base64", "base64url", "string"]
    Keepalive bool
    Enable HTTP keepalive for requests. Default: true
    MaxRequestBodySize float64
    max allowed body size allowed to be handled as MCP request. Default: 8192
    MetadataEndpoint string
    The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource.
    MtlsIntrospectionEndpoint string
    The mTLS alias for the introspection endpoint.
    NoProxy string
    Comma-separated list of hosts to exclude from proxy.
    ScopesSupporteds []string
    SslVerify bool
    Verify the SSL certificate. Default: true
    Timeout float64
    Network I/O timeout in milliseconds. Default: 10000
    TlsClientAuthCert string
    PEM-encoded client certificate for mTLS.
    TlsClientAuthKey string
    PEM-encoded private key for mTLS.
    TlsClientAuthSslVerify bool
    Verify server certificate in mTLS. Default: true
    authorizationServers List<String>
    clientId String
    The client ID for authentication.
    introspectionEndpoint String
    The introspection endpoint URL.
    resource String
    The resource identifier.
    args Map<String,String>
    Additional arguments to send in the POST body.
    cacheIntrospection Boolean
    If enabled, the plugin will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server. Default: true
    claimToHeaders List<GatewayPluginAiMcpOauth2ConfigClaimToHeader>
    clientAlg String
    The client JWT signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]
    clientAuth String
    The client authentication method. must be one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"]
    clientJwk String
    The client JWK for privatekeyjwt authentication.
    clientSecret String
    The client secret for authentication.
    headers Map<String,String>
    Additional headers for the introspection request.
    httpProxy String
    HTTP proxy to use.
    httpProxyAuthorization String
    HTTP proxy authorization header.
    httpVersion Double
    The HTTP version used for requests.
    httpsProxy String
    HTTPS proxy to use.
    httpsProxyAuthorization String
    HTTPS proxy authorization header.
    insecureRelaxedAudienceValidation Boolean
    If enabled, the plugin will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification. Default: false
    introspectionFormat String
    Controls introspection response format. must be one of ["base64", "base64url", "string"]
    keepalive Boolean
    Enable HTTP keepalive for requests. Default: true
    maxRequestBodySize Double
    max allowed body size allowed to be handled as MCP request. Default: 8192
    metadataEndpoint String
    The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource.
    mtlsIntrospectionEndpoint String
    The mTLS alias for the introspection endpoint.
    noProxy String
    Comma-separated list of hosts to exclude from proxy.
    scopesSupporteds List<String>
    sslVerify Boolean
    Verify the SSL certificate. Default: true
    timeout Double
    Network I/O timeout in milliseconds. Default: 10000
    tlsClientAuthCert String
    PEM-encoded client certificate for mTLS.
    tlsClientAuthKey String
    PEM-encoded private key for mTLS.
    tlsClientAuthSslVerify Boolean
    Verify server certificate in mTLS. Default: true
    authorizationServers string[]
    clientId string
    The client ID for authentication.
    introspectionEndpoint string
    The introspection endpoint URL.
    resource string
    The resource identifier.
    args {[key: string]: string}
    Additional arguments to send in the POST body.
    cacheIntrospection boolean
    If enabled, the plugin will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server. Default: true
    claimToHeaders GatewayPluginAiMcpOauth2ConfigClaimToHeader[]
    clientAlg string
    The client JWT signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]
    clientAuth string
    The client authentication method. must be one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"]
    clientJwk string
    The client JWK for privatekeyjwt authentication.
    clientSecret string
    The client secret for authentication.
    headers {[key: string]: string}
    Additional headers for the introspection request.
    httpProxy string
    HTTP proxy to use.
    httpProxyAuthorization string
    HTTP proxy authorization header.
    httpVersion number
    The HTTP version used for requests.
    httpsProxy string
    HTTPS proxy to use.
    httpsProxyAuthorization string
    HTTPS proxy authorization header.
    insecureRelaxedAudienceValidation boolean
    If enabled, the plugin will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification. Default: false
    introspectionFormat string
    Controls introspection response format. must be one of ["base64", "base64url", "string"]
    keepalive boolean
    Enable HTTP keepalive for requests. Default: true
    maxRequestBodySize number
    max allowed body size allowed to be handled as MCP request. Default: 8192
    metadataEndpoint string
    The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource.
    mtlsIntrospectionEndpoint string
    The mTLS alias for the introspection endpoint.
    noProxy string
    Comma-separated list of hosts to exclude from proxy.
    scopesSupporteds string[]
    sslVerify boolean
    Verify the SSL certificate. Default: true
    timeout number
    Network I/O timeout in milliseconds. Default: 10000
    tlsClientAuthCert string
    PEM-encoded client certificate for mTLS.
    tlsClientAuthKey string
    PEM-encoded private key for mTLS.
    tlsClientAuthSslVerify boolean
    Verify server certificate in mTLS. Default: true
    authorization_servers Sequence[str]
    client_id str
    The client ID for authentication.
    introspection_endpoint str
    The introspection endpoint URL.
    resource str
    The resource identifier.
    args Mapping[str, str]
    Additional arguments to send in the POST body.
    cache_introspection bool
    If enabled, the plugin will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server. Default: true
    claim_to_headers Sequence[GatewayPluginAiMcpOauth2ConfigClaimToHeader]
    client_alg str
    The client JWT signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]
    client_auth str
    The client authentication method. must be one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"]
    client_jwk str
    The client JWK for privatekeyjwt authentication.
    client_secret str
    The client secret for authentication.
    headers Mapping[str, str]
    Additional headers for the introspection request.
    http_proxy str
    HTTP proxy to use.
    http_proxy_authorization str
    HTTP proxy authorization header.
    http_version float
    The HTTP version used for requests.
    https_proxy str
    HTTPS proxy to use.
    https_proxy_authorization str
    HTTPS proxy authorization header.
    insecure_relaxed_audience_validation bool
    If enabled, the plugin will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification. Default: false
    introspection_format str
    Controls introspection response format. must be one of ["base64", "base64url", "string"]
    keepalive bool
    Enable HTTP keepalive for requests. Default: true
    max_request_body_size float
    max allowed body size allowed to be handled as MCP request. Default: 8192
    metadata_endpoint str
    The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource.
    mtls_introspection_endpoint str
    The mTLS alias for the introspection endpoint.
    no_proxy str
    Comma-separated list of hosts to exclude from proxy.
    scopes_supporteds Sequence[str]
    ssl_verify bool
    Verify the SSL certificate. Default: true
    timeout float
    Network I/O timeout in milliseconds. Default: 10000
    tls_client_auth_cert str
    PEM-encoded client certificate for mTLS.
    tls_client_auth_key str
    PEM-encoded private key for mTLS.
    tls_client_auth_ssl_verify bool
    Verify server certificate in mTLS. Default: true
    authorizationServers List<String>
    clientId String
    The client ID for authentication.
    introspectionEndpoint String
    The introspection endpoint URL.
    resource String
    The resource identifier.
    args Map<String>
    Additional arguments to send in the POST body.
    cacheIntrospection Boolean
    If enabled, the plugin will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server. Default: true
    claimToHeaders List<Property Map>
    clientAlg String
    The client JWT signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]
    clientAuth String
    The client authentication method. must be one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"]
    clientJwk String
    The client JWK for privatekeyjwt authentication.
    clientSecret String
    The client secret for authentication.
    headers Map<String>
    Additional headers for the introspection request.
    httpProxy String
    HTTP proxy to use.
    httpProxyAuthorization String
    HTTP proxy authorization header.
    httpVersion Number
    The HTTP version used for requests.
    httpsProxy String
    HTTPS proxy to use.
    httpsProxyAuthorization String
    HTTPS proxy authorization header.
    insecureRelaxedAudienceValidation Boolean
    If enabled, the plugin will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification. Default: false
    introspectionFormat String
    Controls introspection response format. must be one of ["base64", "base64url", "string"]
    keepalive Boolean
    Enable HTTP keepalive for requests. Default: true
    maxRequestBodySize Number
    max allowed body size allowed to be handled as MCP request. Default: 8192
    metadataEndpoint String
    The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource.
    mtlsIntrospectionEndpoint String
    The mTLS alias for the introspection endpoint.
    noProxy String
    Comma-separated list of hosts to exclude from proxy.
    scopesSupporteds List<String>
    sslVerify Boolean
    Verify the SSL certificate. Default: true
    timeout Number
    Network I/O timeout in milliseconds. Default: 10000
    tlsClientAuthCert String
    PEM-encoded client certificate for mTLS.
    tlsClientAuthKey String
    PEM-encoded private key for mTLS.
    tlsClientAuthSslVerify Boolean
    Verify server certificate in mTLS. Default: true

    GatewayPluginAiMcpOauth2ConfigClaimToHeader, GatewayPluginAiMcpOauth2ConfigClaimToHeaderArgs

    Claim string
    The claim name to be used in the access token. Not Null
    Header string
    The HTTP header name to be used for forwarding the claim value to the upstream. Not Null
    Claim string
    The claim name to be used in the access token. Not Null
    Header string
    The HTTP header name to be used for forwarding the claim value to the upstream. Not Null
    claim String
    The claim name to be used in the access token. Not Null
    header String
    The HTTP header name to be used for forwarding the claim value to the upstream. Not Null
    claim string
    The claim name to be used in the access token. Not Null
    header string
    The HTTP header name to be used for forwarding the claim value to the upstream. Not Null
    claim str
    The claim name to be used in the access token. Not Null
    header str
    The HTTP header name to be used for forwarding the claim value to the upstream. Not Null
    claim String
    The claim name to be used in the access token. Not Null
    header String
    The HTTP header name to be used for forwarding the claim value to the upstream. Not Null

    GatewayPluginAiMcpOauth2Ordering, GatewayPluginAiMcpOauth2OrderingArgs

    GatewayPluginAiMcpOauth2OrderingAfter, GatewayPluginAiMcpOauth2OrderingAfterArgs

    Accesses List<string>
    Accesses []string
    accesses List<String>
    accesses string[]
    accesses Sequence[str]
    accesses List<String>

    GatewayPluginAiMcpOauth2OrderingBefore, GatewayPluginAiMcpOauth2OrderingBeforeArgs

    Accesses List<string>
    Accesses []string
    accesses List<String>
    accesses string[]
    accesses Sequence[str]
    accesses List<String>

    GatewayPluginAiMcpOauth2Partial, GatewayPluginAiMcpOauth2PartialArgs

    Id string
    A string representing a UUID (universally unique identifier).
    Name string
    A unique string representing a UTF-8 encoded name.
    Path string
    Id string
    A string representing a UUID (universally unique identifier).
    Name string
    A unique string representing a UTF-8 encoded name.
    Path string
    id String
    A string representing a UUID (universally unique identifier).
    name String
    A unique string representing a UTF-8 encoded name.
    path String
    id string
    A string representing a UUID (universally unique identifier).
    name string
    A unique string representing a UTF-8 encoded name.
    path string
    id str
    A string representing a UUID (universally unique identifier).
    name str
    A unique string representing a UTF-8 encoded name.
    path str
    id String
    A string representing a UUID (universally unique identifier).
    name String
    A unique string representing a UTF-8 encoded name.
    path String

    GatewayPluginAiMcpOauth2Route, GatewayPluginAiMcpOauth2RouteArgs

    Id string
    Id string
    id String
    id string
    id str
    id String

    GatewayPluginAiMcpOauth2Service, GatewayPluginAiMcpOauth2ServiceArgs

    Id string
    Id string
    id String
    id string
    id str
    id String

    Import

    In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

    terraform

    import {

    to = konnect_gateway_plugin_ai_mcp_oauth2.my_konnect_gateway_plugin_ai_mcp_oauth2

    id = jsonencode({

    control_plane_id = "9524ec7d-36d9-465d-a8c5-83a3c9390458"
    
    id = "3473c251-5b6c-4f45-b1ff-7ede735a366d"
    

    })

    }

    The pulumi import command can be used, for example:

    $ pulumi import konnect:index/gatewayPluginAiMcpOauth2:GatewayPluginAiMcpOauth2 my_konnect_gateway_plugin_ai_mcp_oauth2 '{"control_plane_id": "9524ec7d-36d9-465d-a8c5-83a3c9390458", "id": "3473c251-5b6c-4f45-b1ff-7ede735a366d"}'
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    konnect kong/terraform-provider-konnect
    License
    Notes
    This Pulumi package is based on the konnect Terraform Provider.
    konnect logo
    konnect 3.4.1 published on Wednesday, Oct 29, 2025 by kong
      Meet Neo: Your AI Platform Teammate