slug: kong provider: Kong generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Banking & Capital Markets - Software & Technology min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 43 edges: - tag: Roles spec_file: kong-roles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: POST /v3/users/{userId}/assigned-roles users-assign-role Assign Role; POST /v3/teams/{teamId}/assigned-roles teams-assign-role Assign Team Role; schema AssignedRole reason: Operations grant, list and revoke predefined roles for users and teams in the Konnect control plane — role-based access control administration, which is squarely Identity & Access Management. - tag: System Accounts - Roles spec_file: kong-system-accounts-roles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /v3/system-accounts/{accountId}/assigned-roles Create Assigned Role for System Account; schema AssignedRole reason: Assigning and removing authorisation roles for system (machine) accounts — role-based access control administration, i.e. Identity & Access Management. - tag: Metering Events spec_file: kong-metering-events-api-openapi.yml capability_id: BC-4250.10 capability_id_l1: BC-4250 capability_name: Usage Metering confidence: 0.82 evidence: POST /v3/openmeter/events ingest-metering-events Ingest metering events reason: Ingestion of usage/metering events (OpenMeter) that feed downstream rating and billing — directly Usage Metering. - tag: OpenMeter Subscriptions spec_file: kong-openmeter-subscriptions-api-openapi.yml capability_id: BC-4240 capability_id_l1: BC-4240 capability_name: Subscription Lifecycle Management confidence: 0.82 evidence: POST /v3/openmeter/subscriptions/{subscriptionId}/cancel cancel-subscription Cancel subscription reason: Create, change, cancel and unschedule cancellation of subscriptions — subscription lifecycle management; spans provisioning, modification and cancellation so L1 only. - tag: Snippets spec_file: kong-snippets-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.82 evidence: GET /v3/portals/{portalId}/snippets list-portal-snippets List Snippets; schema CreatePortalSnippetRequest, PortalSnippetInfo, VisibilityStatus reason: Full lifecycle of reusable content snippets scoped to a developer portal, including visibility status — content authoring for the developer portal that documents and onboards API consumers. - tag: API Specification spec_file: kong-api-specification-api-openapi.yml capability_id: BC-4270.10 capability_id_l1: BC-4270 capability_name: Public API Lifecycle Management confidence: 0.8 evidence: POST /v3/apis/{apiId}/specifications create-api-spec Create API Specification; POST /v3/apis/validate-specification reason: Directly manages and validates OpenAPI specifications of APIs exposed via Kong — public API specification lifecycle. - tag: Auth Settings spec_file: kong-auth-settings-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: '"Create Identity Provider", "Update Team Mappings", schemas "SAMLIdentityProviderConfig", "OIDCIdentityProviderClaimMappings"' reason: Configures identity providers, SSO federation and team/group mappings for platform users — identity and access management / federation. - tag: Config Store Secrets spec_file: kong-config-store-secrets-api-openapi.yml capability_id: BC-4210.60 capability_id_l1: BC-4210 capability_name: Configuration & Secrets Management confidence: 0.8 evidence: POST /v2/control-planes/{controlPlaneId}/config-stores/{configStoreId}/secrets Create Config Store Secret reason: Operations manage secrets held in config stores consumed by gateway runtime — squarely Configuration & Secrets Management. - tag: Meters spec_file: kong-meters-api-openapi.yml capability_id: BC-4250.10 capability_id_l1: BC-4250 capability_name: Usage Metering confidence: 0.8 evidence: POST /v3/openmeter/meters create-meter Create meter reason: CRUD over meter definitions in OpenMeter, i.e. configuration of usage aggregation used for consumption-based billing — Usage Metering. - tag: Team Membership spec_file: kong-team-membership-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: POST /v3/teams/{teamId}/users "Add User"; GET /v3/users/{userId}/teams "List User Teams" reason: Assignment of users to teams that govern admin permissions in Kong Konnect — group membership for access control, mapping to Identity & Access Management. - tag: Transit Gateways spec_file: kong-transit-gateways-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.8 evidence: POST /v2/cloud-gateways/networks/{networkId}/transit-gateways "Create Transit Gateway"; schemas CreateAwsVpcPeeringGateway, AzureVNETPeeringAttachmentConfig reason: Manages AWS/Azure/GCP network attachments and VPC/VNet peering for cloud gateway networks — cloud network infrastructure management. - tag: API Version spec_file: kong-api-version-api-openapi.yml capability_id: BC-4270.10 capability_id_l1: BC-4270 capability_name: Public API Lifecycle Management confidence: 0.78 evidence: POST /v3/apis/{apiId}/versions create-api-version Create API Version reason: Versioning of catalogued APIs matches 'Specification, versioning, and deprecation of public APIs exposed to external developers'. - tag: Groups spec_file: kong-groups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: POST /groups "Create a new Group"; POST /groups/{GroupId}/roles "Create Group's Roles"; schema GroupRole reason: Admin API groups with attached roles are RBAC constructs for administrative access control, which is identity & access management. No other reading of group+role assignment fits. - tag: Portals spec_file: kong-portals-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.78 evidence: POST /v3/portals create-portal Create Portal; GET /v3/portals list-portals List Portals reason: Lifecycle management of Kong's developer portals, which are the documentation/onboarding surface for external API consumers — Developer Portal Management. - tag: Users spec_file: kong-users-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: GET /v3/users "List Users"; PATCH /v3/users/{userId} "Update User"; schema User reason: User account lifecycle within Kong's admin/ACL surface — administrative identity records, i.e. IAM, not HR employee records. - tag: Pages spec_file: kong-pages-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.76 evidence: GET /v3/portals/{portalId}/pages list-portal-pages List Pages reason: Authoring and organisation of developer portal content pages (including boilerplate default content) — Developer Portal Management. - tag: API spec_file: kong-api-api-openapi.yml capability_id: BC-4270.10 capability_id_l1: BC-4270 capability_name: Public API Lifecycle Management confidence: 0.75 evidence: '''POST /v3/apis create-api Create API'', ''ApiSpecType'', ''ApiVersionSummary''' reason: CRUD over API entities with spec type and version summary in Kong's API platform corresponds to public API lifecycle/specification and versioning management. - tag: API Package Specification spec_file: kong-api-package-specification-api-openapi.yml capability_id: BC-4270.10 capability_id_l1: BC-4270 capability_name: Public API Lifecycle Management confidence: 0.75 evidence: PUT /v3/api-packages/{packageId}/current-specification update-api-package-current-specification; schema ApiSpec reason: Stewardship of the OpenAPI specification for an API package — specification management for publicly exposed APIs. - tag: API Publication spec_file: kong-api-publication-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.75 evidence: PUT /v3/apis/{apiId}/publications/{portalId} publish-api-to-portal Publish API; GET /v3/portals/{portalId}/api-publications reason: Publishing APIs and API packages to developer portals (including AutoApproveRegistrations) is developer portal management within the API ecosystem capability. - tag: Config Stores spec_file: kong-config-stores-api-openapi.yml capability_id: BC-4210.60 capability_id_l1: BC-4210 capability_name: Configuration & Secrets Management confidence: 0.75 evidence: POST /v2/control-planes/{controlPlaneId}/config-stores Create Config Store; schema ConfigStore reason: Config stores hold runtime configuration/secret backends for control planes; maps to Configuration & Secrets Management, though the entity itself is a container rather than the values. - tag: OpenMeter Billing spec_file: kong-openmeter-billing-api-openapi.yml capability_id: BC-4250 capability_id_l1: BC-4250 capability_name: Subscription Billing & Revenue Management confidence: 0.75 evidence: POST /v3/openmeter/profiles create-billing-profile Create a new billing profile reason: Management of billing profiles and their invoicing/collection workflow settings (BillingWorkflowPaymentSendInvoiceSettings) — subscription billing configuration; spans invoicing and collection so L1 only. - tag: Portal Customization spec_file: kong-portal-customization-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.75 evidence: GET /v3/portals/{portalId}/customization Get Customization; schemas PortalFooterMenuSection, PortalMenuItem reason: Branding, menus and layout of the developer portal are direct stewardship of the developer-facing documentation/onboarding surface. - tag: System Accounts spec_file: kong-system-accounts-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: POST /v3/system-accounts post-system-accounts Create System Account; schema SystemAccount reason: Lifecycle management of non-human machine/service accounts used to access the Konnect control plane. This is identity administration; could alternatively be read as developer credential management, hence moderate confidence. - tag: System Accounts - Access Tokens spec_file: kong-system-accounts-access-tokens-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: POST /v3/system-accounts/{accountId}/access-tokens Create System Account Access Token; schema SystemAccountAccessToken reason: Issuance, rotation and revocation of access tokens for machine accounts — credential lifecycle within identity and access management. Ambiguity with developer credential management keeps confidence moderate. - tag: System Accounts - Team Membership spec_file: kong-system-accounts-team-membership-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: POST /v3/teams/{teamId}/system-accounts "Add System Account to a Team"; schemas Team, SystemAccount reason: Operations attach and detach machine/system accounts to administrative teams in Kong's admin API — group-based access control over the control plane, i.e. identity and access management, not a business-domain capability. - tag: RBACUsers spec_file: kong-rbacusers-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.74 evidence: POST /{workspace}/rbac/users create-rbac_user Create a new RBAC User; schema RBACUser reason: Lifecycle of administrative users for role-based access control of the gateway — Identity & Access Management, not HR employee records. - tag: API Documentation spec_file: kong-api-documentation-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.72 evidence: POST /v3/apis/{apiId}/documents create-api-document Create API Document; schemas ApiDocumentTitle, ApiDocumentSlug, ApiDocumentStatus reason: Kong Konnect manages documentation pages attached to APIs that are published to developer portals — API documentation content for external developers, i.e. developer portal documentation, not a generic content capability. - tag: API Package Documentation spec_file: kong-api-package-documentation-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.72 evidence: POST /v3/api-packages/{packageId}/documents create-api-package-document Create API Package Document reason: Documentation pages for API packages published to developer portals — developer-facing documentation management. - tag: GraphQL Cost Decorations spec_file: kong-graphql-cost-decorations-api-openapi.yml capability_id: BC-4270.50 capability_id_l1: BC-4270 capability_name: API Consumption Governance confidence: 0.72 evidence: GET /v2/control-planes/{controlPlaneId}/core-entities/graphql-rate-limiting-advanced/costs — "List all GraphQL Cost Decorations" reason: The operations configure cost weightings used by the GraphQL rate-limiting-advanced plugin, i.e. quota/rate-limit policy for API consumption on a gateway service. That is API consumption governance, not a business-domain capability. - tag: OpenMeter Entitlements spec_file: kong-openmeter-entitlements-api-openapi.yml capability_id: BC-4240.70 capability_id_l1: BC-4240 capability_name: Entitlement Enforcement confidence: 0.72 evidence: list-customer-entitlement-access List customer entitlement access reason: Resolution of a customer's entitlement access (BillingEntitlementAccessResult) for runtime access decisions — Entitlement Enforcement. - tag: RBACRoles spec_file: kong-rbacroles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: POST /{workspace}/rbac/roles create-rbac_role Create a new RBAC Role; schema RBACRole reason: Role lifecycle for role-based access control on the Kong Admin API — Identity & Access Management. - tag: RBACUserRoles spec_file: kong-rbacuserroles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: POST /{workspace}/rbac/users/{RBACUserIdForNestedEntities}/roles Create a new RBAC User Role reason: Assignment of roles to RBAC users — authorisation administration, i.e. Identity & Access Management. - tag: ACLs spec_file: kong-acls-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: '''Create a new ACL associated with a Consumer'', schemas ACL, ACLWithoutParents' reason: Kong Gateway ACL entities govern which API consumers may access which routes — access control administration, mapping to Identity & Access Management. Confidence moderated as it is gateway-level authorization plumbing rather than enterprise IAM. - tag: API-keys spec_file: kong-api-keys-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: '"Create a new API-key associated with a Consumer", schema "KeyAuth"' reason: Operations manage API key credentials for gateway consumers — credential/identity and access management. Could also be read as developer credential management, but the surface is gateway consumer authentication, so IAM is the safer mapping. - tag: App Auth Strategies spec_file: kong-app-auth-strategies-api-openapi.yml capability_id: BC-4270.40 capability_id_l1: BC-4270 capability_name: Developer Identity & Credential Management confidence: 0.7 evidence: '"Create App Auth Strategy", schemas "AppAuthStrategyOpenIDConnectRequest", "AppAuthStrategyKeyAuthRequest"' reason: Defines authentication strategies (OIDC, key-auth, DCR provider) applied to developer portal applications — governance of developer/app credentials on an API platform. - tag: Application Registrations spec_file: kong-application-registrations-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.7 evidence: '"List Registrations by Portal", "Get a Registration", schema "ApplicationRegistrationStatus"' reason: Manages developer-portal application registrations for API access — developer portal / API ecosystem onboarding. Sub-capability choice (portal vs consumption governance) is somewhat ambiguous. - tag: Applications spec_file: kong-applications-api-openapi.yml capability_id: BC-4270.30 capability_id_l1: BC-4270 capability_name: Developer Portal Management confidence: 0.7 evidence: '"List Applications", "List Credentials by Application", "List Developers by Application"' reason: Developer-portal applications with credentials and associated developers — developer portal / API ecosystem management on an API platform. - tag: Consumer Groups spec_file: kong-consumer-groups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /{workspace}/consumer_groups/{ConsumerGroupId}/consumers Add consumer to consumer group reason: Consumer groups in Kong group API consumer identities for access/rate-limit policy; identity and access grouping. 'Consumer' here is an API client identity, not an end customer. - tag: Consumers spec_file: kong-consumers-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /v2/control-planes/{controlPlaneId}/core-entities/consumers Create a new Consumer; List all Consumer Groups a Consumer belongs to reason: Kong Consumers are API client identities used for authentication and authorisation at the gateway — identity & access management, not customer relationship data. Could also be read as developer credential management (BC-4270.40). - tag: DCR Providers spec_file: kong-dcr-providers-api-openapi.yml capability_id: BC-4270.40 capability_id_l1: BC-4270 capability_name: Developer Identity & Credential Management confidence: 0.7 evidence: POST /v2/dcr-providers create-dcr-provider Create DCR provider; schemas DcrProviderOkta, DcrProviderCurity reason: Dynamic Client Registration providers configure how developer/application OAuth clients are issued credentials against an IdP, which maps to developer identity and credential management for the API ecosystem. - tag: Portal Auth Settings spec_file: kong-portal-auth-settings-api-openapi.yml capability_id: BC-4270.40 capability_id_l1: BC-4270 capability_name: Developer Identity & Credential Management confidence: 0.7 evidence: 'POST /v3/portals/{portalId}/identity-providers create-portal-identity-provider Create Identity Provider; schemas: OIDCIdentityProviderConfig, SAMLAuthEnabled, PortalTeamGroupMappingsUpdateRequest' reason: Federation of external identity providers (OIDC/SAML) and group-to-team mapping for developer portal users matches 'federated developer identity' under developer identity and credential management. - tag: RBACUserGroups spec_file: kong-rbacusergroups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /{workspace}/rbac/users/{RBACUserIdForNestedEntities}/groups Create a new RBAC User Group reason: Group membership for RBAC users controlling administrative access — Identity & Access Management. - tag: Vaults spec_file: kong-vaults-api-openapi.yml capability_id: BC-4210.60 capability_id_l1: BC-4210 capability_name: Configuration & Secrets Management confidence: 0.7 evidence: POST /{workspace}/vaults "Create a new Vault"; schema Vault reason: Kong Vault entities register secret backends used to resolve runtime configuration secrets for gateway services, matching Configuration & Secrets Management.