# developer.konghq.com > Kong's developer documentation for Kong Gateway, Kong Konnect, Kong AI Gateway, Kong Mesh, and more. This file lists all available documentation pages as Markdown. Each link points to the LLM-optimized Markdown version of the page. Use this file to discover and fetch content for RAG pipelines, AI agents, or LLM context. --- ## API Reference - [Gateway Admin - EE OpenAPI Specification](https://developer.konghq.com/api/gateway/admin-ee/3.16.md): Kong Gateway (EE) comes with an internal RESTful API for administration purposes. - [Gateway Dev Portal OpenAPI Specification](https://developer.konghq.com/api/gateway/dev-portal/v1.md): Dev Portal provides a single source of truth for all developers to locate, access, and consume services for Kong Gateway EE. This spec is a Beta version. - [Gateway Status OpenAPI Specification](https://developer.konghq.com/api/gateway/status/v1.md): Gateway Status is a read-only endpoint allowing monitoring tools to retrieve metrics, healthiness, and other non-sensitive information of the node. - [Konnect AI Catalog OpenAPI Specification](https://developer.konghq.com/api/konnect/ai-builder/v1.md): Konnect AI Catalog is the API for creating and managing AI interfaces in the Konnect Catalog. - [Konnect AI Gateway OpenAPI Specification](https://developer.konghq.com/api/konnect/ai-gateway/v1.md): The API for configuring AI Gateways in Konnect. - [Konnect Analytics Dashboards OpenAPI Specification](https://developer.konghq.com/api/konnect/analytics-dashboards/v2.md): Konnect endpoint for creating, reading, updating, and deleting dashboards. Dashboards are entities within Konnect that contain tiles, which are essentially saved queries combined with configuration for a chart to render the data. - [Konnect Metrics Endpoint OpenAPI Specification](https://developer.konghq.com/api/konnect/analytics-metrics/v2.md): Konnect endpoint for extracting and computing metrics, similar to the data that is used to build graphs in Konnect Advanced Analytics. - [Konnect API Request OpenAPI Specification](https://developer.konghq.com/api/konnect/analytics-requests/v2.md): API Requests provides access to detailed records for requests made to your API, in near real-time. - [Konnect API Catalog OpenAPI Specification](https://developer.konghq.com/api/konnect/api-builder/v3.md): The management API for creating, managing APIs in the Konnect API Catalog, and publishing APIs in Dev Portals. - [Konnect API Products (Legacy) OpenAPI Specification](https://developer.konghq.com/api/konnect/api-products/v2.md): Legacy API for managing API Products on the classic Dev Portal (v2). For new integrations, see API Builder v3. - [Application Auth Strategies OpenAPI Specification](https://developer.konghq.com/api/konnect/application-auth-strategies/v2.md): Application Auth Strategies are used to manage authentication to your APIs. - [Konnect Audit Logging OpenAPI Specification](https://developer.konghq.com/api/konnect/audit-logs/v3.md): Audit logging enables administrators to better spot security risks and maintain compliance of their core infrastructure. - [Dedicated Cloud Gateways OpenAPI Specification](https://developer.konghq.com/api/konnect/cloud-gateways/v2.md): Konnect API for managing Dedicated Cloud Gateways infrastructure configuration. - [Konnect CMEK OpenAPI Specification](https://developer.konghq.com/api/konnect/cmek/v1.md): Customer Managed Encryption Keys - [Consumers OpenAPI Specification](https://developer.konghq.com/api/konnect/consumers/v1.md): Centralized consumer management across a Konnect region that can be referenced across multiple control planes - [Konnect Context Mesh OpenAPI Specification](https://developer.konghq.com/api/konnect/context-interfaces/v1.md): The platform API for Konnect Context Mesh - [Konnect Control Planes Config OpenAPI Specification](https://developer.konghq.com/api/konnect/control-planes-config/v2.md): Manage Kong Gateway services, routes, certificates, consumer, and global configuration within Konnect. - [Konnect Control Planes OpenAPI Specification](https://developer.konghq.com/api/konnect/control-planes/v2.md): Manage the control plane entity in Konnect. - [Konnect Developer Portal OpenAPI Specification](https://developer.konghq.com/api/konnect/dev-portal/v3.md): The API that powers the Konnect Developer Portal. Access portal data from the perspective of a Portal user, rather than a Portal administrator. - [Konnect Developer Portal - Errors OpenAPI Specification](https://developer.konghq.com/api/konnect/dev-portal/v3/errors.md): Konnect Developer Portal Custom Error Codes. - [Konnect Event Gateway OpenAPI Specification](https://developer.konghq.com/api/konnect/event-gateway/v1.md): A proxy for the native Kafka protocol that sits between native consumers and producers, and backend Kafka clusters. - [Konnect Identity Management OpenAPI Specification](https://developer.konghq.com/api/konnect/identity/v3.md): Identity Management is responsible for Konnect users, teams, organization, roles, permissions, and IdP settings. - [Kong Identity Principals and Directories OpenAPI Specification](https://developer.konghq.com/api/konnect/kong-identity-principals/v2.md): The Konnect API for managing Kong Identity principals and directories. - [Kong Identity Auth Servers OpenAPI Specification](https://developer.konghq.com/api/konnect/kong-identity/v1.md): The Konnect API for managing Kong Identity auth servers. - [Konnect Search OpenAPI Specification](https://developer.konghq.com/api/konnect/ksearch/v1.md): The search API for Kong Konnect. - [Konnect Mesh Manager OpenAPI Specification](https://developer.konghq.com/api/konnect/mesh-control-planes/v0.md): The Mesh Manager API can be used to create and manage your global mesh control planes. - [Metering & Billing OpenAPI Specification](https://developer.konghq.com/api/konnect/metering-and-billing/v3.md): Konnect Metering & Billing API - [Konnect Notification Hub OpenAPI Specification](https://developer.konghq.com/api/konnect/notification-hub/v1.md): Notification Hub API for Konnect. - [Konnect Organization Management OpenAPI Specification](https://developer.konghq.com/api/konnect/organizations/v3.md): Manage organizational level settings for Konnect - [Konnect Portal Management OpenAPI Specification](https://developer.konghq.com/api/konnect/portal-management/v3.md): Integrate portal management operations with automation systems (such as CI/CD pipelines) using this AIP-compliant API. - [Konnect Service Catalog OpenAPI Specification](https://developer.konghq.com/api/konnect/service-catalog/v1.md): The Service Catalog API. ## AI Gateway - [Kong AI Gateway](https://developer.konghq.com/ai-gateway.md): This page is an introduction to AI Gateway. - [A2A Traffic Gateway](https://developer.konghq.com/ai-gateway/a2a.md): Observe Agent-to-Agent (A2A) protocol traffic through AI Gateway. - [AI Gateway audit log reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference.md): AI Gateway provides a standardized logging format for AI Policies, enabling the emission of analytics events and facilitating the aggregation of AI usage analytics across various providers. - [Proxy AI CLI tools through AI Gateway](https://developer.konghq.com/ai-gateway/ai-clis.md): Configure AI Gateway to proxy requests from AI command-line tools to LLM providers for logging, cost tracking, and rate limiting. - [AI Gateway Data Governance](https://developer.konghq.com/ai-gateway/ai-data-gov.md): This page provides an overview of AI Gateway safety, security and compliance features. - [AI Gateway 2.x concepts](https://developer.konghq.com/ai-gateway/ai-gateway-v2-concepts.md): This page describes the differences between the AI Gateway running on Kong Gateway plugin model (V1) and the new AI Gateway 2.x Policies model. - [AI Gateway logs](https://developer.konghq.com/ai-gateway/ai-logs.md): See where AI Gateway logs are located, the different log levels, and how to configure logs and log levels. - [Gen AI OpenTelemetry metrics reference](https://developer.konghq.com/ai-gateway/ai-otel-metrics.md): Reference for OpenTelemetry metrics emitted by AI Gateway for generative AI, MCP, and A2A traffic. - [AI Gateway providers](https://developer.konghq.com/ai-gateway/ai-providers.md): This page is an introduction to the AI providers available in AI Gateway. - [Anthropic provider](https://developer.konghq.com/ai-gateway/ai-providers/anthropic.md): Reference for supported capabilities for Anthropic provider - [Azure OpenAI provider](https://developer.konghq.com/ai-gateway/ai-providers/azure.md): Reference for supported capabilities for Azure OpenAI provider - [Amazon Bedrock provider](https://developer.konghq.com/ai-gateway/ai-providers/bedrock.md): Reference for supported capabilities for Amazon Bedrock provider - [Cerebras provider](https://developer.konghq.com/ai-gateway/ai-providers/cerebras.md): Reference for supported capabilities for Cerebras provider - [Cohere provider](https://developer.konghq.com/ai-gateway/ai-providers/cohere.md): Reference for supported capabilities for Cohere provider - [DashScope provider](https://developer.konghq.com/ai-gateway/ai-providers/dashscope.md): Reference for supported capabilities for DashScope provider - [Databricks provider](https://developer.konghq.com/ai-gateway/ai-providers/databricks.md): Reference for supported capabilities for Databricks provider - [DeepSeek provider](https://developer.konghq.com/ai-gateway/ai-providers/deepseek.md): Reference for supported capabilities for DeepSeek provider - [Gemini provider](https://developer.konghq.com/ai-gateway/ai-providers/gemini.md): Reference for supported capabilities for the Gemini provider, covering both Gemini Standard and Gemini Enterprise - [Hugging Face provider](https://developer.konghq.com/ai-gateway/ai-providers/huggingface.md): Reference for supported capabilities for Hugging Face provider - [Kimi provider](https://developer.konghq.com/ai-gateway/ai-providers/kimi.md): Reference for supported capabilities for Kimi provider - [Llama provider](https://developer.konghq.com/ai-gateway/ai-providers/llama.md): Reference for supported capabilities for Llama provider - [Mistral provider](https://developer.konghq.com/ai-gateway/ai-providers/mistral.md): Reference for supported capabilities for Mistral provider - [Ollama provider](https://developer.konghq.com/ai-gateway/ai-providers/ollama.md): Reference for supported capabilities for Ollama provider - [OpenAI provider](https://developer.konghq.com/ai-gateway/ai-providers/openai.md): Reference for supported capabilities for OpenAI provider - [Amazon SageMaker provider](https://developer.konghq.com/ai-gateway/ai-providers/sagemaker.md): Reference for supported capabilities for Amazon SageMaker provider - [TypeSafe AI provider](https://developer.konghq.com/ai-gateway/ai-providers/typesafe.md): Reference for supported capabilities for TypeSafe AI provider - [Vercel provider](https://developer.konghq.com/ai-gateway/ai-providers/vercel.md): Reference for supported capabilities for Vercel provider - [vLLM provider](https://developer.konghq.com/ai-gateway/ai-providers/vllm.md): Reference for supported capabilities for vLLM - [xAI provider](https://developer.konghq.com/ai-gateway/ai-providers/xai.md): Reference for supported capabilities for xAI provider - [AI Gateway architecture](https://developer.konghq.com/ai-gateway/architecture.md): Understand the architecture of AI Gateway, including its control plane and data plane, how AI entities translate into data plane configuration, and its deployment and multi-tenancy topologies. - [Kong AI Gateway changelog](https://developer.konghq.com/ai-gateway/changelog.md): Changelog for supported Kong AI Gateway versions. - [Kong AI Gateway configuration reference](https://developer.konghq.com/ai-gateway/configuration.md): Reference for Kong AI Gateway configuration parameters. Set these parameters in kong.conf. - [Configure Kong AI Gateway on-prem](https://developer.konghq.com/ai-gateway/configure-on-prem.md): Configure Kong AI Gateway on self-hosted Kong Gateway using the 3.x data model and AI plugins, and map each core entity to its plugin. - [Custom policies](https://developer.konghq.com/ai-gateway/custom-policies.md): Custom AI Policies let you deploy your own plugin schema and handler in AI Gateway, either streamed from the control plane or installed directly on data planes. - [AI Gateway entities](https://developer.konghq.com/ai-gateway/entities.md): This page lists the entities that make up AI Gateway. - [AI Agents](https://developer.konghq.com/ai-gateway/entities/ai-agent.md): AI Agent entity used by AI Gateway for A2A and HTTP agent configurations. - [AI Auth Strategies](https://developer.konghq.com/ai-gateway/entities/ai-auth-strategy.md): Configure inbound AI Consumer authentication for AI Models, AI Agents, and AI MCP Servers in AI Gateway. - [AI CA Certificates](https://developer.konghq.com/ai-gateway/entities/ai-ca-certificate.md): Store public certificates from trusted Certificate Authorities to verify the validity of AI Certificates. - [AI Certificates](https://developer.konghq.com/ai-gateway/entities/ai-certificate.md): A PEM-encoded certificate and its matching private key, used to terminate or originate TLS connections on an AI Gateway data plane. - [AI Consumer Groups](https://developer.konghq.com/ai-gateway/entities/ai-consumer-group.md): AI Consumer Groups for AI Gateway. - [AI Consumers](https://developer.konghq.com/ai-gateway/entities/ai-consumer.md): AI Consumers for AI Gateway. - [AI Data Plane Certificates](https://developer.konghq.com/ai-gateway/entities/ai-data-plane-certificate.md): Client certificates that authorize data planes to connect to an AI Gateway. - [AI MCP Servers](https://developer.konghq.com/ai-gateway/entities/ai-mcp-server.md): AI MCP Server entity used by AI Gateway to expose tools and proxy MCP traffic. - [AI Model Providers](https://developer.konghq.com/ai-gateway/entities/ai-model-provider.md): AI Model Provider credentials and configuration used by AI Gateway. - [AI Models](https://developer.konghq.com/ai-gateway/entities/ai-model.md): AI Models registered with the AI Gateway. - [AI Policies](https://developer.konghq.com/ai-gateway/entities/ai-policy.md): AI Policies for AI Gateway. - [AI SNIs](https://developer.konghq.com/ai-gateway/entities/ai-sni.md): A many-to-one mapping of hostnames to a certificate, used to select the TLS certificate an AI Gateway data plane presents to a client. - [AI Vaults](https://developer.konghq.com/ai-gateway/entities/ai-vault.md): AI Vaults for storing and referencing secrets used by AI Gateway entities. - [FIPS 140-3 compliance in AI Gateway](https://developer.konghq.com/ai-gateway/fips-support.md): Learn how to enable FIPS mode and how AI Gateway is FIPS 140-3 compliant. - [Forward proxy support](https://developer.konghq.com/ai-gateway/forward-proxy.md): Route outbound traffic from AI Gateway Policies through a forward proxy to operate in network-isolated environments without breaking load balancing, streaming, WebSocket, or HTTP/2. - [Using kongctl to manage AI Gateway](https://developer.konghq.com/ai-gateway/kongctl.md): Learn how to use kongctl to create and inspect AI Gateway resources in Kong Konnect. - [Gen AI OpenTelemetry spans attributes reference](https://developer.konghq.com/ai-gateway/llm-open-telemetry.md): Reference for OpenTelemetry Gen AI span attributes emitted by AI Gateway for generative AI requests. - [Load balancing with Kong AI Gateway](https://developer.konghq.com/ai-gateway/load-balancing.md): This guide provides an overview of load balancing and retry and fallback strategies in AI Gateway. - [MCP version support](https://developer.konghq.com/ai-gateway/mcp-version-support.md): What's new in the MCP 2026-07-28 specification and how AI Gateway supports it. - [MCP Traffic Gateway](https://developer.konghq.com/ai-gateway/mcp.md): This page is an introduction to MCP Traffic Gateway capabilities in AI Gateway. - [Model cost management in Kong AI Gateway](https://developer.konghq.com/ai-gateway/model-cost-management.md): How AI Gateway prices models and calculates the cost of a request. - [Monitor AI LLM metrics](https://developer.konghq.com/ai-gateway/monitor-ai-llm-metrics.md): This guide walks you through collecting AI metrics and sending them to Prometheus. - [Passthrough format in AI Gateway](https://developer.konghq.com/ai-gateway/passthrough.md): Proxy AI traffic that AI Gateway can't parse, forwarding unchanged request and response bodies while keeping upstream authentication, rate limiting, and logging. - [Kong AI Gateway Policies](https://developer.konghq.com/ai-gateway/policies.md): An overview of policies that work with Kong AI Gateway. - [Kong AI Gateway resource sizing guidelines](https://developer.konghq.com/ai-gateway/resource-sizing-guidelines-ai.md): Review AI Gateway recommended resource allocation sizing guidelines for AI Gateway based on configuration and traffic patterns. - [AI Gateway software bill of materials](https://developer.konghq.com/ai-gateway/sbom.md): Kong provides a software bill of materials (SBOM) for every AI Gateway release, starting with 2.0.2. - [Embedding-based similarity matching in AI Gateway](https://developer.konghq.com/ai-gateway/semantic-similarity.md): This reference explains how AI Gateway uses embedding-based similarity to compare prompts with various inputs, such as cached entries, target model descriptions, document chunks, or allow/deny lists. - [Streaming with AI Gateway](https://developer.konghq.com/ai-gateway/streaming.md): This guide walks you through setting up AI Models with streaming. - [Migrate to AI Gateway 2.x](https://developer.konghq.com/ai-gateway/v2-migration-guide.md): This guide walks you through moving your configuration from the AI Gateway running on Kong Gateway plugin model to the new AI Gateway 2.x Policies model. - [AI Gateway version support policy](https://developer.konghq.com/ai-gateway/version-support-policy.md): The AI Gateway version support policy outlines the AI Gateway versioning scheme and version lifecycle, from release to sunset support. - [Kong Gateway OpenTelemetry metrics reference](https://developer.konghq.com/gateway/otel-metrics.md): Reference for OpenTelemetry metrics emitted by Kong Gateway. - [MCP Traffic Gateway](https://developer.konghq.com/mcp.md): This page is an introduction to MCP Traffic Gateway capabilites in AI Gateway. ## Catalog - [Konnect Catalog Classic](https://developer.konghq.com/catalog-classic.md): Learn how to track and manage services across your organization with the Konnect Catalog Classic. - [Konnect Catalog](https://developer.konghq.com/catalog.md): Learn how to create, discover, and govern the interfaces your organization publishes and consumes with Konnect Catalog. - [Agents in Catalog](https://developer.konghq.com/catalog/agents.md): An Agent is an interface in Catalog that represents an A2A-compatible agent your organization builds or consumes. Learn how to create and manage Agents. - [AI Models in Catalog](https://developer.konghq.com/catalog/ai-models.md): An AI Model is an interface in Catalog that represents the providers and target models your organization routes requests to. Learn how to create and manage AI Models. - [Package APIs](https://developer.konghq.com/catalog/api-packaging.md): Learn how to package APIs in Catalog and Dev Portal and what API packages are. - [API catalog](https://developer.konghq.com/catalog/apis.md): An API is the interface that you publish to your end customer. Developers register applications for use with specific API. - [Catalog integrations](https://developer.konghq.com/catalog/integrations.md): Integrate third-party applications into your Konnect organization. - [API Gateway](https://developer.konghq.com/catalog/integrations/api-gateway.md): The API Gateway integration is built directly into Catalog Classic, so no additional authorization is needed. - [AWS API Gateway](https://developer.konghq.com/catalog/integrations/aws-api-gateway.md): The AWS API Gateway integration allows you to associate your Catalog Classic service with one or more AWS API Gateway APIs. - [Azure API management](https://developer.konghq.com/catalog/integrations/azure-api-management.md): placeholder - [Azure DevOps](https://developer.konghq.com/catalog/integrations/azure-devops.md): description: Provides information about the Azure DevOps integration, which lets the Konnect Catalog Classic read repository metadata from Azure DevOps and use it for service mapping and governance workflows. - [Datadog](https://developer.konghq.com/catalog/integrations/datadog.md): The Datadog integration lets you connect Datadog entities directly to your Catalog Classic services. - [Dynatrace](https://developer.konghq.com/catalog/integrations/dynatrace.md): The Dynatrace integration lets you connect Dynatrace classic service-level objects directly to your Catalog Classic services. - [GitHub](https://developer.konghq.com/catalog/integrations/github.md): The GitHub integration allows you to associate your Catalog Classic service to one or more GitHub repositories. - [GitLab](https://developer.konghq.com/catalog/integrations/gitlab.md): The GitLab integration allows you to associate your Catalog Classic Service to one or more GitLab projects - [Observability](https://developer.konghq.com/catalog/integrations/konnect-analytics.md): Connect reports from Observability - [PagerDuty](https://developer.konghq.com/catalog/integrations/pagerduty.md): The PagerDuty integration allows you to provide a way to alert on information about current open incidents to consumers of the service directory. - [Service Mesh integration](https://developer.konghq.com/catalog/integrations/service-mesh.md): Map Mesh Services from Konnect Service Mesh to visualize how configuration and policies are distributed across mesh deployments in multiple zones. - [Slack](https://developer.konghq.com/catalog/integrations/slack.md): The Slack integration allows you to see Slack communication channels that are relevant to a Catalog Classic service. - [SonarQube](https://developer.konghq.com/catalog/integrations/sonarqube.md): The SonarQube integration lets you connect SonarQube SaaS projects directly to your Catalog Classic services. - [SwaggerHub](https://developer.konghq.com/catalog/integrations/swaggerhub.md): The SwaggerHub integration lets you connect SwaggerHub API specs directly to your Catalog Classic services. - [Traceable](https://developer.konghq.com/catalog/integrations/traceable.md): The Traceable integration lets you connect Traceable entities directly to your Catalog Classic services. - [MCP registries in Catalog (tech preview)](https://developer.konghq.com/catalog/mcp-registry.md): An MCP Registry is a centralized publishing and discovery endpoint for MCP servers within your organization. Learn how to register your MCP servers in Konnect Catalog. - [MCP servers in Catalog](https://developer.konghq.com/catalog/mcp-servers.md): An MCP server is an interface in Catalog that represents an MCP server your organization builds or consumes. Learn how to create and manage MCP servers. - [Migrate API specs in Catalog to APIs](https://developer.konghq.com/catalog/migrate-api-specs-to-apis.md): Learn how to migrate API specs in Catalog to APIs. - [Konnect scorecards](https://developer.konghq.com/catalog/scorecards.md): Scorecards in Catalog Classic allow platform teams to monitor services for compliance with Kong-recommended and industry-defined best practices in Konnect. - [Catalog Classic services](https://developer.konghq.com/catalog/services.md): Learn about services in Catalog Classic and how to configure them. ## Context Mesh - [Context Mesh](https://developer.konghq.com/context-mesh.md): Turn enterprise APIs into Code Mode MCP servers that AI agents can call directly, and combine them with existing MCP servers to customize the overall enterprise context under a single source of truth. ## Dev Portal - [Dev Portal](https://developer.konghq.com/dev-portal.md): Manage API publishing, developer self-service, and documentation with Konnect Dev Portal. - [Dev Portal analytics](https://developer.konghq.com/dev-portal/analytics.md): Learn how to view contextual developer, client app, and Dev Portal analytics. - [Dev Portal breaking changes](https://developer.konghq.com/dev-portal/breaking-changes.md): Review breaking changes from Dev Portal v3 beta to GA. - [Custom domains](https://developer.konghq.com/dev-portal/custom-domains.md): Use a custom URL for Dev Portal. - [Dev Portal customizations](https://developer.konghq.com/dev-portal/customizations/dev-portal-customizations.md): Customize the look, structure, and access of your Dev Portal with flexible page controls and branding options - [Dev Portal developer RBAC](https://developer.konghq.com/dev-portal/developer-rbac.md): The Dev Portal allows you to manage developers by creating teams and assigning specific roles for each API. - [Dev Portal developer sign-up](https://developer.konghq.com/dev-portal/developer-signup.md): Learn how developers can get started with the Dev Portal by registering and creating an application. - [Dev Portal Dynamic Client Registration](https://developer.konghq.com/dev-portal/dynamic-client-registration.md): Describes supported DCR identity providers and supported DCR authentication methods. - [Dev Portal MCP server](https://developer.konghq.com/dev-portal/mcp-servers.md): Learn how Dev Portal exposes published APIs to AI agents as an MCP server, and how its settings control what agents can read and do. - [Migrate your classic Dev Portal (v2) Terraform resource](https://developer.konghq.com/dev-portal/migrate-classic-dev-portal-resource-with-terraform.md): Learn how to migrate your classic Dev Portal (v2) `konnect_portal` Terraform resource to `konnect_portal_classic`. - [Dev Portal pages and content](https://developer.konghq.com/dev-portal/pages-and-content.md): Customize Dev Portal Pages using Markdown Components (MDC). - [Global Dev Portal configuration](https://developer.konghq.com/dev-portal/portal-settings.md): Learn about the settings you can configure for Dev Portal. - [Dev Portal access and authentication settings](https://developer.konghq.com/dev-portal/security-settings.md): Security settings help you configure visibility and access control for developers accessing your Dev Portal. - [Developer self-service and application registration](https://developer.konghq.com/dev-portal/self-service.md): Enable self-service registration flows for developers and applications using authentication strategies and Konnect application auth. - [Dev Portal SSO](https://developer.konghq.com/dev-portal/sso.md): Set up SSO for the Konnect Dev Portal using OpenID Connect (OIDC) or SAML. - [Dev Portal team mapping](https://developer.konghq.com/dev-portal/team-mapping.md): Map existing developer teams from a third-party identity provider (IdP) and their permissions to elements in a Konnect Dev Portal. - [Migrate from classic Dev Portal (v2) to the new Dev Portal (v3)](https://developer.konghq.com/dev-portal/v2-migration.md): Learn how to migrate from the classic Dev Portal (v2) to the new Dev Portal (v3). ## Event Gateway - [Event Gateway](https://developer.konghq.com/event-gateway.md): A Kafka proxy for controlled, secure client access to your Kafka cluster—both internal and external. - [Kong Event Gateway architecture](https://developer.konghq.com/event-gateway/architecture.md): How does Kong Event Gateway work? - [Event Gateway breaking changes and known issues](https://developer.konghq.com/event-gateway/breaking-changes.md): Review Event Gateway version breaking changes before upgrading. - [Kong Event Gateway changelog](https://developer.konghq.com/event-gateway/changelog.md): Changelog for supported Kong Event Gateway versions. - [Event Gateway configuration reference](https://developer.konghq.com/event-gateway/configuration.md): Reference for Kong Event Gateway data plane configuration parameters. - [Kong Event Gateway entities](https://developer.konghq.com/event-gateway/entities.md): This page lists the different entities that make up Kong Event Gateway. - [Backend clusters](https://developer.konghq.com/event-gateway/entities/backend-cluster.md): Backend clusters represent target Kafka clusters proxies by Kong Event Gateway. - [Listeners](https://developer.konghq.com/event-gateway/entities/listener.md): Listeners represent the network interface for Kafka client connections over TCP. - [Policies](https://developer.konghq.com/event-gateway/entities/policy.md): Policies control how Kafka protocol traffic is modified between the client and the backend cluster. - [Schema registry](https://developer.konghq.com/event-gateway/entities/schema-registry.md): Schema registries are resources that let you validate messages against the Confluent schema registry. - [Static keys](https://developer.konghq.com/event-gateway/entities/static-key.md): Static encryption keys are resources that can be used by the Encrypt and Decrypt policies to encrypt and decrypt Kafka messages. - [TLS trust bundles](https://developer.konghq.com/event-gateway/entities/tls-trust-bundle.md): TLS trust bundles store CA certificates used to verify client certificates during mutual TLS (mTLS) handshakes. - [Virtual clusters](https://developer.konghq.com/event-gateway/entities/virtual-cluster.md): Virtual clusters are Event Gateway entities that expose a modified view of the backend cluster to clients. - [Event Gateway expressions language](https://developer.konghq.com/event-gateway/expressions.md): Reference for the expressions language used for defining Event Gateway conditions. - [Kong Event Gateway headers](https://developer.konghq.com/event-gateway/headers.md): Reference for all headers added or interpreted by Kong Event Gateway. - [Kong Event Gateway known limitations](https://developer.konghq.com/event-gateway/known-limitations.md): This page lists the current Kong Event Gateway limitations. - [Kong Event Gateway metrics](https://developer.konghq.com/event-gateway/metrics.md): Reference for all metrics exposed by Kong Event Gateway. - [Event Gateway Policies](https://developer.konghq.com/event-gateway/policies.md): An overview of policies that work with Event Gateway. - [ACLs Policy](https://developer.konghq.com/event-gateway/policies/acl.md): Manage access to your virtual cluster resources. - [ACLs: Allow consumer group management](https://developer.konghq.com/event-gateway/policies/acl/examples/manage-consumer-groups.md): Allow the principal to create and delete consumer groups. - [ACLs: Allow access to topics using a claim expression](https://developer.konghq.com/event-gateway/policies/acl/examples/match-claims-using-expressions.md): Allow the principal full access to all topics with a prefix determined by an expression. - [ACLs: Allow read-only access to a topic](https://developer.konghq.com/event-gateway/policies/acl/examples/read-only-topic.md): Allow the principal to consume messages for a specific topic. - [ACLs Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/acl/reference.md): Manage access to your virtual cluster resources. - [Decrypt Fields Policy](https://developer.konghq.com/event-gateway/policies/decrypt-fields.md): Decrypt fields of a Kafka message that were previously encrypted using the referenced key. - [Decrypt Fields: Decrypt fields using an AWS key vault](https://developer.konghq.com/event-gateway/policies/decrypt-fields/examples/decrypt-with-aws.md): Decrypt a message field using a specific AWS key vault. - [Decrypt Fields: Decrypt fields with a dynamic list of fields](https://developer.konghq.com/event-gateway/policies/decrypt-fields/examples/decrypt-with-dynamic-paths.md): Use a dynamic expression to decrypt fields of a message value. - [Decrypt Fields: Decrypt fields using a static key](https://developer.konghq.com/event-gateway/policies/decrypt-fields/examples/decrypt-with-static-key.md): Decrypt a message field using a static key. - [Decrypt Fields Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/decrypt-fields/reference.md): Decrypt fields of a Kafka message that were previously encrypted using the referenced key. - [Decrypt Policy](https://developer.konghq.com/event-gateway/policies/decrypt.md): Decrypt messages that were previously encrypted using the referenced key - [Decrypt: Decrypt using an AWS key vault](https://developer.konghq.com/event-gateway/policies/decrypt/examples/decrypt-with-aws.md): Decrypt a message value using a specific AWS key vault. - [Decrypt: Decrypt using a static key](https://developer.konghq.com/event-gateway/policies/decrypt/examples/decrypt-with-static-key.md): Decrypt a message value using a static key. - [Decrypt Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/decrypt/reference.md): Decrypt messages that were previously encrypted using the referenced key - [Encrypt Fields Policy](https://developer.konghq.com/event-gateway/policies/encrypt-fields.md): Encrypt fields of Kafka records. - [Encrypt Fields: Encrypt fields with AWS Key Vault](https://developer.konghq.com/event-gateway/policies/encrypt-fields/examples/encrypt-with-aws.md): Use an AWS Key Vault to encrypt fields of a message value. - [Encrypt Fields: Encrypt fields with a dynamic list of fields](https://developer.konghq.com/event-gateway/policies/encrypt-fields/examples/encrypt-with-dynamic-paths.md): Use a dynamic expression to encrypt fields of a message value. - [Encrypt Fields: Encrypt fields using a static key](https://developer.konghq.com/event-gateway/policies/encrypt-fields/examples/encrypt-with-static-key.md): Encrypt fields of a message value using a static key. - [Encrypt Fields Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/encrypt-fields/reference.md): Encrypt fields of Kafka records. - [Encrypt Policy](https://developer.konghq.com/event-gateway/policies/encrypt.md): Encrypt portions of Kafka records - [Encrypt: Encrypt with AWS Key Vault](https://developer.konghq.com/event-gateway/policies/encrypt/examples/encrypt-with-aws.md): Use an AWS Key Vault to encrypt message values. - [Encrypt: Encrypt using a static key](https://developer.konghq.com/event-gateway/policies/encrypt/examples/encrypt-with-static-key.md): Encrypt a message value using a static key. - [Encrypt Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/encrypt/reference.md): Encrypt portions of Kafka records - [Forward to Virtual Cluster Policy](https://developer.konghq.com/event-gateway/policies/forward-to-virtual-cluster.md): Forward messages from a Kafka client to a virtual cluster - [Forward to Virtual Cluster: Forward via port mapping](https://developer.konghq.com/event-gateway/policies/forward-to-virtual-cluster/examples/port-mapping.md): Map listener ports to forward messages from a Kafka client to a virtual cluster. - [Forward to Virtual Cluster: Forward via SNI routing with shared suffix](https://developer.konghq.com/event-gateway/policies/forward-to-virtual-cluster/examples/sni-routing-shared-suffix.md): Use SNI routing to forward messages from a Kafka client to a virtual cluster. With shared suffix, a single wildcard certificate covers all virtual clusters. Example hostnames generated with this configuration: * `bootstrap-my-virtual-cluster.example.mycompany.com` * `broker-1-my-virtual-cluster.example.mycompany.com` - [Forward to Virtual Cluster: Forward via SNI routing](https://developer.konghq.com/event-gateway/policies/forward-to-virtual-cluster/examples/sni-routing.md): Use SNI routing to forward messages from a Kafka client to a virtual cluster. Example hostnames generated with this configuration: * `bootstrap.my-virtual-cluster.example.mycompany.com` * `broker-1.my-virtual-cluster.example.mycompany.com` - [Forward to Virtual Cluster Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/forward-to-virtual-cluster/reference.md): Forward messages from a Kafka client to a virtual cluster - [Modify Headers Policy](https://developer.konghq.com/event-gateway/policies/modify-headers.md): Set or remove record headers - [Modify Headers: Add header based on a condition](https://developer.konghq.com/event-gateway/policies/modify-headers/examples/add-header-based-on-condition.md): Add a header to a record if it meets a specific condition. - [Modify Headers: Apply as a nested policy](https://developer.konghq.com/event-gateway/policies/modify-headers/examples/nested-policy.md): Apply a Modify Headers policy as a nested policy within a Schema Validation policy. - [Modify Headers: Remove and replace a header](https://developer.konghq.com/event-gateway/policies/modify-headers/examples/remove-and-replace-header.md): Remove a header and replace it with another header. - [Modify Headers Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/modify-headers/reference.md): Set or remove record headers - [Schema Validation Consume Policy](https://developer.konghq.com/event-gateway/policies/schema-validation-consume.md): Validate records against a schema during the consume phase - [Schema Validation Consume: Validate messages for a topic](https://developer.konghq.com/event-gateway/policies/schema-validation-consume/examples/validate-a-topic.md): Ensure that all messages consumed from a topic are validated against a schema, and skip messages that don't conform. - [Schema Validation Consume: Validate messages against a Confluent Schema Registry](https://developer.konghq.com/event-gateway/policies/schema-validation-consume/examples/validate-all-confluent.md): Ensure that all messages consumed from any topic are validated against a Confluent Schema Registry, and mark messages that don't conform. - [Schema Validation Consume: Validate messages against JSON for subset of topics](https://developer.konghq.com/event-gateway/policies/schema-validation-consume/examples/validate-subset-json.md): Ensure that all messages consumed from topics with a specific prefix are valid JSONs, and skip messages that don't conform. - [Schema Validation Consume Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/schema-validation-consume/reference.md): Validate records against a schema during the consume phase - [Schema Validation Produce Policy](https://developer.konghq.com/event-gateway/policies/schema-validation-produce.md): Validate records against a schema during the produce phase - [Schema Validation Produce: Validate messages for a topic](https://developer.konghq.com/event-gateway/policies/schema-validation-produce/examples/validate-a-topic.md): Ensure that messages produced to a topic are validated against a schema, and reject messages that don't conform. - [Schema Validation Produce: Validate messages against a Confluent Schema Registry](https://developer.konghq.com/event-gateway/policies/schema-validation-produce/examples/validate-all-confluent.md): Ensure that messages produced to any topic are validated against a Confluent Schema Registry, and mark messages that don't conform. - [Schema Validation Produce: Validate messages against JSON for subset of topics](https://developer.konghq.com/event-gateway/policies/schema-validation-produce/examples/validate-subset-json.md): Ensure that messages produced to topics with a specific prefix are valid JSONs, and reject messages that don't conform. - [Schema Validation Produce Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/schema-validation-produce/reference.md): Validate records against a schema during the produce phase - [Skip Records Policy](https://developer.konghq.com/event-gateway/policies/skip-record.md): Skip the processing of a record - [Skip Records: Apply as a nested policy](https://developer.konghq.com/event-gateway/policies/skip-record/examples/nested-policy.md): Apply a Skip Record policy as a nested policy within a Schema Validation policy. - [Skip Records: Skip processing a record based on a condition](https://developer.konghq.com/event-gateway/policies/skip-record/examples/skip-based-on-name.md): Skip processing a record if it meets a specific condition. - [Skip Records Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/skip-record/reference.md): Skip the processing of a record - [TLS Server Policy](https://developer.konghq.com/event-gateway/policies/tls-server.md): Configure TLS settings for a server - [TLS Server: Allow TLS connections](https://developer.konghq.com/event-gateway/policies/tls-server/examples/tls-connection.md): Allow TLS connections to the Event Gateway server. - [TLS Server Policy Configuration Reference](https://developer.konghq.com/event-gateway/policies/tls-server/reference.md): Configure TLS settings for a server - [Upgrading Event Gateway](https://developer.konghq.com/event-gateway/upgrade.md): This guide walks you through upgrading Kong Event Gateway control planes and data planes. - [Kong Event Gateway version support policy](https://developer.konghq.com/event-gateway/version-support-policy.md): The Kong Event Gateway version support policy outlines the Kong Event Gateway versioning scheme and lifecycle, from release to sunset support. ## Insomnia - [Inso CLI](https://developer.konghq.com/inso-cli.md): This page is an introduction to Inso CLI, a command line tool for Insomnia. - [Inso CLI configuration](https://developer.konghq.com/inso-cli/configuration.md): Inso CLI can be configured with a configuration file, allowing you to specify options and scripts. - [Continuous Integration with Inso CLI](https://developer.konghq.com/inso-cli/continuous-integration.md): Inso CLI is designed to run in a Continuous Integration (CI) environment. - [CLI Documentation](https://developer.konghq.com/inso-cli/reference.md) - [export](https://developer.konghq.com/inso-cli/reference/export.md) - [export spec](https://developer.konghq.com/inso-cli/reference/export_spec.md) - [generate-docs](https://developer.konghq.com/inso-cli/reference/generate-docs/13.1.md) - [lint](https://developer.konghq.com/inso-cli/reference/lint.md) - [lint spec](https://developer.konghq.com/inso-cli/reference/lint_spec.md) - [run](https://developer.konghq.com/inso-cli/reference/run.md) - [run collection](https://developer.konghq.com/inso-cli/reference/run_collection.md) - [run test](https://developer.konghq.com/inso-cli/reference/run_test.md) - [script](https://developer.konghq.com/inso-cli/reference/script.md) - [Inso CLI software bill of materials (SBOM)](https://developer.konghq.com/inso-cli/sbom.md): Kong provides a software bill of materials (SBOM) for Inso CLI. - [Verifying build provenance for signed Inso CLI binaries](https://developer.konghq.com/inso-cli/verify-binary-provenance.md): Kong produces build provenance for Inso CLI binary artifacts, which can be verified. - [Verifying build provenance for signed Inso CLI binaries](https://developer.konghq.com/inso-cli/verify-docker-image-provenance.md): Kong produces build provenance for Inso CLI Docker images artifacts, which can be verified. - [Verify signatures for signed Inso CLI Docker images](https://developer.konghq.com/inso-cli/verify-docker-image-signature.md): Inso CLI Docker container images are signed using cosign with signatures published to a Docker Hub repository. - [Insomnia](https://developer.konghq.com/insomnia.md): Introduction to Insomnia, the open source desktop application that simplifies designing, debugging, and testing APIs. - [Keyboard shortcuts for Insomnia](https://developer.konghq.com/insomnia/Keyboard-shortcuts.md): Learn about keyboard shortcuts you can use in the Insomnia desktop application. - [Accounts](https://developer.konghq.com/insomnia/accounts.md): Learn how to manage your Insomnia account. - [AI in Insomnia](https://developer.konghq.com/insomnia/ai-in-insomnia.md): Explore AI features in Insomnia 12, including MCP Servers, AI-assisted mock servers, and commit suggestions. Learn how to connect, configure, and manage AI integrations across your workspace. - [Insomnia proxy and allowlist](https://developer.konghq.com/insomnia/allowlist.md): A reference of domains to allowlist to ensure Insomnia is operating correctly within your organization. - [API specs in Insomnia](https://developer.konghq.com/insomnia/api-specs.md): API specifications explain how an API behaves and how it interacts with other APIs. - [Authentication and authorization](https://developer.konghq.com/insomnia/authentication-authorization.md): Secure Insomnia with native or external authentication and authorization. - [Collected data](https://developer.konghq.com/insomnia/collected-data.md): Insomnia collects usage analytics data to help improve the application. - [API Collections in Insomnia](https://developer.konghq.com/insomnia/collections.md): This page is an introduction to API Collections in Insomnia, which hold your requests, environments, and OpenAPI spec. - [Convert project storage types in Insomnia](https://developer.konghq.com/insomnia/convert-project-storage.md): Learn what happens when you change a project storage type in Insomnia, including supported conversions, limitations, prerequisites, and FAQs. - [Data security](https://developer.konghq.com/insomnia/data-security.md): Learn the options that Insomnia offers to encrypt and store encrypted data. - [Design APIs](https://developer.konghq.com/insomnia/design.md): Introduction to API design in Insomnia. - [Dynamic Mocking](https://developer.konghq.com/insomnia/dynamic-mocking.md): Use dynamic mocking in Insomnia mock servers to return request-aware responses and realistic mock data. - [Dynamic variables](https://developer.konghq.com/insomnia/dynamic-variables.md): Define variables dynamically using scripts and iteration data. - [Enterprise account management](https://developer.konghq.com/insomnia/enterprise-account-management.md): Learn how to manage your Insomnia Enterprise account. - [Get started with Insomnia Enterprise](https://developer.konghq.com/insomnia/enterprise-onboarding.md): Learn how to set up your Insomnia Enterprise instance. - [Enterprise user management](https://developer.konghq.com/insomnia/enterprise-user-management.md): Learn how to manage your Insomnia Enterprise users and licenses. - [Insomnia Enterprise](https://developer.konghq.com/insomnia/enterprise.md): Learn more about the features available in the Insomnia Enterprise plan. - [Environments](https://developer.konghq.com/insomnia/environments.md): Configure environment variables to reuse values across multiple requests. - [External vault integration](https://developer.konghq.com/insomnia/external-vault.md): Learn how to configure external vault integrations in Insomnia using AWS, GCP, Azure, and HashiCorp vault providers. - [Faker Variables](https://developer.konghq.com/insomnia/faker-variables.md): Generate random data from Liquid faker variables in Insomnia mock servers with dynamic mocking. - [Git Sync](https://developer.konghq.com/insomnia/git-sync.md): Connect Insomnia directly to your Git repository. - [GraphQL queries](https://developer.konghq.com/insomnia/graphql.md): Learn how to write, send, and debug GraphQL queries in Insomnia using the built-in query editor, variable section, and schema introspection. - [gRPC requests in Insomnia](https://developer.konghq.com/insomnia/grpc-requests.md): Insomnia allows you to configure and send different types of requests. - [Import and export reference for Insomnia](https://developer.konghq.com/insomnia/import-export.md): Learn how to import and export data in Insomnia using the UI and the Inso CLI, and which formats are supported. - [Incident response and vulnerability management](https://developer.konghq.com/insomnia/incident-response.md): We monitor the security of our products and applications through various ongoing activities, including logs. - [Insomnia vs Postman](https://developer.konghq.com/insomnia/insomnia-vs-postman.md): Compare Insomnia and Postman at a glance. See how Insomnia's open-source foundation, plugin ecosystem, and Kong integrations make it faster, lighter, and more flexible for API design and testing. - [Konnect Gateway Service integration in Insomnia](https://developer.konghq.com/insomnia/konnect-integration.md): Link Konnect to send requests from Insomnia to Routes in your Gateway Services. - [Manage Insomnia](https://developer.konghq.com/insomnia/manage-insomnia.md): Learn how to manage Insomnia accounts, organizations, users, and security. - [MCP clients in Insomnia](https://developer.konghq.com/insomnia/mcp-clients-in-insomnia.md): Learn about MCP servers in Insomnia, connect Insomnia to an MCP Server, and discover available tools, prompts, and resources. - [Migrate from scratch pad to Enterprise](https://developer.konghq.com/insomnia/migrate-to-enterprise-from-scratchpad.md): Migrate all of the data from your scratch pad account to your Enterprise account. - [Mocks](https://developer.konghq.com/insomnia/mock-servers.md): This page is an introduction to mock servers in Insomnia. - [Organizations](https://developer.konghq.com/insomnia/organizations.md): Learn how to manage your Insomnia organizations. - [Insomnia plugins](https://developer.konghq.com/insomnia/plugins.md): This page is an introduction to Insomnia plugins. - [Context object reference](https://developer.konghq.com/insomnia/plugins/context-object-reference.md): Context methods provide helpers for plugins to communicate, interact, and integrate with Insomnia. - [Hooks and actions](https://developer.konghq.com/insomnia/plugins/hooks-and-actions.md): Hooks and actions allow you to add additional functionality to your custom plugins through requests, responses, and UI interactions. - [Plugin reference](https://developer.konghq.com/insomnia/plugins/plugin-reference.md): Learn about Insomnia's plugin context that allow plugins to interact with requests, responses, the app UI, and stored data. - [Insomnia RBAC](https://developer.konghq.com/insomnia/rbac.md): Insomnia allows admins to scope user access with Role-Based Access Control. - [Insomnia release and versioning policy](https://developer.konghq.com/insomnia/release-policy.md): How Insomnia releases new versions, with recommendations for updating. - [Request authentication reference](https://developer.konghq.com/insomnia/request-authentication.md): Learn what request authentication is and how to authenticate requests in Insomnia. - [Requests in Insomnia](https://developer.konghq.com/insomnia/requests.md): Insomnia allows you to configure and send different types of requests. - [Run in Insomnia](https://developer.konghq.com/insomnia/run-in-insomnia.md): Reference for constructing deep-link URLs that open Insomnia to an imported request. - [Insomnia software bill of materials (SBOM)](https://developer.konghq.com/insomnia/sbom.md): Kong provides a software bill of materials (SBOM) for Insomnia - [System for Cross-domain Identity Management (SCIM) for Insomnia](https://developer.konghq.com/insomnia/scim.md): Learn how to configure SCIM provisioning for your Enterprise account. - [Scripts in Insomnia](https://developer.konghq.com/insomnia/scripts.md): Learn how to write pre-request and after-response scripts in Insomnia. - [Self-hosted mocks](https://developer.konghq.com/insomnia/self-hosted-mocks.md): Insomnia allows users to create self-hosted mock servers. - [Single Sign-On (SSO) for Insomnia](https://developer.konghq.com/insomnia/sso.md): Learn how to configure SSO for your Enterprise account. - [Storage options in Insomnia](https://developer.konghq.com/insomnia/storage.md): Insomnia offers various storage options to cater to different user needs and preferences. - [Template tags](https://developer.konghq.com/insomnia/template-tags.md): A template tag is a type of variable that you can use to reference or transform values. - [Insomnia terminology](https://developer.konghq.com/insomnia/terminology.md): This page defines terminology and concepts related to Insomnia. - [Test APIs](https://developer.konghq.com/insomnia/test.md): This page is an introduction to API testing in Insomnia. - [Insomnia 3-way merge](https://developer.konghq.com/insomnia/three-way-merge.md): Learn how Insomnia handles conflicts during Git sync so you can combine concurrent changes safely. - [Git Sync projects migration for Insomnia 12.6](https://developer.konghq.com/insomnia/upgrade/git-sync-12.6.md): This guide walks you through migrating your Git Sync project structure to use Insomnia 12.6. - [Verifying build provenance for signed Insomnia binaries](https://developer.konghq.com/insomnia/verify-binary-provenance.md): Kong produces build provenance for Insomnia application binary artifacts, which can be verified. - [Koh CLI, the agent-friendly CLI for Insomnia](https://developer.konghq.com/koh.md): This page is an introduction to Koh CLI, an agent-friendly command line tool for Insomnia. ## Kong Gateway - [Kong Admin API](https://developer.konghq.com/admin-api.md): This page is an introduction to the Kong Gateway Admin API. - [Custom plugins](https://developer.konghq.com/custom-plugins.md): This page is an introduction to custom plugins for Kong. - [api.lua](https://developer.konghq.com/custom-plugins/api.lua.md): Learn how to extend the Admin API using api.lua. - [daos.lua](https://developer.konghq.com/custom-plugins/daos.lua.md): Learn how to define schemas for custom entities using daos.lua. - [Data store](https://developer.konghq.com/custom-plugins/data-store.md): Learn how to interact with the Kong Gateway data store in your custom plugin. - [Custom plugin deployment options](https://developer.konghq.com/custom-plugins/deployment-options.md): Learn about the different ways to deploy a custom plugin. - [Writing plugins in Go](https://developer.konghq.com/custom-plugins/go.md): Learn how to write plugins for Kong Gateway in Go. - [handler.lua](https://developer.konghq.com/custom-plugins/handler.lua.md): Learn how to implement custom plugin logic using handler.lua. - [Installation and distribution of custom plugins](https://developer.konghq.com/custom-plugins/installation-and-distribution.md): Learn about the different ways to deploy a custom plugin. - [Writing plugins in JavaScript](https://developer.konghq.com/custom-plugins/javascript.md): Learn how to write plugins for Kong Gateway in JavaScript. - [Custom plugins in Konnect hybrid mode](https://developer.konghq.com/custom-plugins/konnect-hybrid-mode.md): Learn how to deploy a custom plugin in Konnect. - [Metrics PDK](https://developer.konghq.com/custom-plugins/metrics-pdk.md): Learn how to register and record custom metrics from a custom plugin using the Metrics PDK. - [Migration modules](https://developer.konghq.com/custom-plugins/migrations.md): Learn how to create migration modules to create database tables to store custom entities and update them for new plugin versions. - [Writing plugins in Python](https://developer.konghq.com/custom-plugins/python.md): Learn how to write plugins for Kong Gateway in Python. - [Custom plugin reference](https://developer.konghq.com/custom-plugins/reference.md): Learn about how to develop custom plugins for Kong Gateway. - [schema.lua](https://developer.konghq.com/custom-plugins/schema.lua.md): Learn how to enable plugin configuration options using schema.lua. - [Streaming custom plugins](https://developer.konghq.com/custom-plugins/streaming-plugins.md): Define custom plugin logic directly in Kong Gateway configuration and have it distributed to all data planes automatically. - [Testing custom plugins](https://developer.konghq.com/custom-plugins/testing.md): Learn how to write tests for custom plugins. - [Dedicated Cloud Gateways](https://developer.konghq.com/dedicated-cloud-gateways.md): Learn how Dedicated Cloud Gateways work and how to configure them. - [Dedicated Cloud Gateway data plane logs](https://developer.konghq.com/dedicated-cloud-gateways/konnect-logs.md): Review logs for data plane activity in Konnect Dedicated Cloud Gateways. - [Managed cache for Redis](https://developer.konghq.com/dedicated-cloud-gateways/managed-cache.md): Learn how to configure and scale a Dedicated Cloud Gateway managed cache for Redis. See recommended sizing configurations based on use case. - [Multi-cloud Dedicated Cloud Gateway network architecture](https://developer.konghq.com/dedicated-cloud-gateways/multi-cloud.md): Learn how to deploy Dedicated Cloud Gateways across multiple cloud providers, including supported hostname strategies and their tradeoffs. - [Dedicated Cloud Gateways network architecture](https://developer.konghq.com/dedicated-cloud-gateways/network-architecture.md): Learn the architecture of Kong-managed Dedicated Cloud Gateways networks, how they communicate with your cloud infrastructure, and what you must decide before deploying a Dedicated Cloud Gateway. - [Dedicated Cloud Gateways private network architecture and security](https://developer.konghq.com/dedicated-cloud-gateways/private-network.md): Learn about private Dedicated Cloud Gateway network architecture, connectivity options, and how to secure your private network. - [Dedicated Cloud Gateways production readiness guide](https://developer.konghq.com/dedicated-cloud-gateways/production-readiness.md): Learn how to verify that your Dedicated Cloud Gateway configuration is secure and production-ready. - [Dedicated Cloud Gateways public network architecture and security](https://developer.konghq.com/dedicated-cloud-gateways/public-network.md): Learn about the public Dedicated Cloud Gateway network architecture and how to secure your public network. - [Dedicated Cloud Gateways reference](https://developer.konghq.com/dedicated-cloud-gateways/reference.md): Dedicated Cloud Gateways are Data Plane nodes that are fully managed by Kong in Konnect. - [AWS Transit Gateway peering](https://developer.konghq.com/dedicated-cloud-gateways/transit-gateways.md): Connect Konnect Dedicated Cloud Gateways to AWS Transit Gateway for private, secure connectivity. - [Application authentication strategies](https://developer.konghq.com/dev-portal/auth-strategies.md): Learn how to set up authentication strategies for application registration in Dev Portal. - [Kong Gateway](https://developer.konghq.com/gateway.md): This page is an introduction to Kong Gateway. - [Kong Gateway Amazon RDS database authentication with AWS IAM](https://developer.konghq.com/gateway/amazon-rds-authentication-with-aws-iam.md): Learn how to use AWS Identity and Access Management (IAM) authentication to connect to the Amazon RDS database that you use for Kong Gateway - [Kong Gateway audit logs](https://developer.konghq.com/gateway/audit-logs.md): Kong Gateway audit logs provide details about HTTP requests handled by the Admin API, as well as database changes. - [Authentication](https://developer.konghq.com/gateway/authentication.md): An introduction to authentication with Kong Gateway. - [Connect a Kong Gateway Azure PostgreSQL Server using Azure Service Principal](https://developer.konghq.com/gateway/azure-pg-authentication-with-azure-app-service-principal.md): Learn how to use Azure Service Principal authentication to connect to the Azure PostgreSQL Server that you use for Kong Gateway - [Connect a Kong Gateway Azure PostgreSQL Server using Azure Managed Identity](https://developer.konghq.com/gateway/azure-pg-authentication-with-azure-managed-identity.md): Learn how to use Azure Managed Identity authentication to connect to the Azure PostgreSQL Server that you use for Kong Gateway - [Kong Gateway breaking changes, deprecations, and known issues](https://developer.konghq.com/gateway/breaking-changes.md): Review Kong Gateway version breaking changes, deprecations, and known issues before upgrading. - [Kong Gateway changelog](https://developer.konghq.com/gateway/changelog.md): Changelog for supported Kong Gateway Enterprise versions. - [CLI Reference](https://developer.konghq.com/gateway/cli/reference.md) - [Cloud provider integration support for Kong Gateway Enterprise](https://developer.konghq.com/gateway/cloud-provider-support-matrix.md): Learn which Kong Gateway Enterprise features support cloud IAM authentication with AWS, Azure, and GCP, and which authentication methods are available for each provider. - [Kong Gateway configuration reference](https://developer.konghq.com/gateway/configuration.md): Reference for Kong Gateway configuration parameters. Set these parameters in kong.conf. - [Control plane groups](https://developer.konghq.com/gateway/control-plane-groups.md): A control plane group is a read-only control plane that combines configuration from its members, which are standard control planes. - [Default resource limits for control planes](https://developer.konghq.com/gateway/control-plane-resource-limits.md): In Konnect, every control plane has a default resource limit per Gateway entity. - [Kong Gateway Control Plane and Data Plane communication](https://developer.konghq.com/gateway/cp-dp-communication.md): Learn how Control Planes communicate with Data Planes and how you can secure them. - [Control Plane outage management](https://developer.konghq.com/gateway/cp-outage.md): Configure Data Plane resilience in case of a Control Plane outage. - [Testing regional failover](https://developer.konghq.com/gateway/cross-regional-failover-testing.md): Simulate a regional outage to verify that your multi-region Konnect data plane automatically fails over to a healthy region. - [Data Plane reference](https://developer.konghq.com/gateway/data-plane-reference.md): Manage Data Plane nodes in Konnect, including platform support, proxy access, version upgrades, certificate renewal, required parameters, and custom metadata labels. - [Version compatibility in control planes](https://developer.konghq.com/gateway/data-plane-version-compatibility.md): Running multiple versions of data plane nodes with a single control plane can cause version compatibility issues. - [Datakit flow editor](https://developer.konghq.com/gateway/datakit-flow-editor.md): Explains how to use the Datakit flow editor in the Konnect UI - [Datakit](https://developer.konghq.com/gateway/datakit.md): Datakit is a Kong Gateway plugin and workflow engine for interacting with third-party APIs. It allows you to combine API responses, transform data, manage secrets, and build powerful request-processing pipelines. - [DB-less mode](https://developer.konghq.com/gateway/db-less-mode.md): Explains how Kong Gateway can be run without a database using only in-memory storage for entities. - [Debug Kong Gateway requests](https://developer.konghq.com/gateway/debug-requests.md): Collect timing information about a given request. - [Kong Gateway deployment topologies](https://developer.konghq.com/gateway/deployment-topologies.md): This page lists the different modes that you can deploy Kong Gateway in. - [Kong Gateway entities](https://developer.konghq.com/gateway/entities.md): This page lists the different entities that make up Kong Gateway. - [Admins](https://developer.konghq.com/gateway/entities/admin.md): Admins can manage Kong Gateway entities inside Workspaces, including users and their roles. - [CA Certificates](https://developer.konghq.com/gateway/entities/ca-certificate.md): A CA Certificate object represents a trusted certificate authority. These objects are used by Kong Gateway to verify the validity of a client or server certificate. - [Certificates](https://developer.konghq.com/gateway/entities/certificate.md): A Certificate object represents a public certificate, and can be optionally paired with the corresponding private key. - [Consumer Groups](https://developer.konghq.com/gateway/entities/consumer-group.md): Consumer Groups let you apply common configurations to groups of Consumers, such as rate limiting policies or request and response transformation. - [Consumers](https://developer.konghq.com/gateway/entities/consumer.md): A Consumer is an entity that identifies an external client that consumes or uses the APIs managed by Kong Gateway. - [Event Hooks](https://developer.konghq.com/gateway/entities/event-hook.md): Event Hooks allow Kong Gateway monitor to communicate with target services or resources, notifying the target resource that an event was triggered. - [Groups](https://developer.konghq.com/gateway/entities/group.md): Groups are a resource for RBAC and can be used to assign Roles across sets of users. - [Key Sets](https://developer.konghq.com/gateway/entities/key-set.md): A Key Set is a collection of Kong Gateway Keys. - [Keys](https://developer.konghq.com/gateway/entities/key.md): A Key object holds a representation of asymmetric keys in various formats. - [Licenses](https://developer.konghq.com/gateway/entities/license.md): A License entity allows you manage self-managed Kong Gateway Enterprise licenses. - [Partials](https://developer.konghq.com/gateway/entities/partial.md): Partials allow you to extract shared configurations into reusable entities that can be linked to multiple plugins - [Plugins](https://developer.konghq.com/gateway/entities/plugin.md): Plugins are modules that extend the functionality of Kong Gateway. - [RBAC](https://developer.konghq.com/gateway/entities/rbac.md): RBAC manages Kong Gateway roles and permissions for Kong Manager and the Admin API. - [Routes](https://developer.konghq.com/gateway/entities/route.md): A Route uses specific URL patterns and HTTP verbs to match incoming requests and pass them to a Gateway Service. This determines which upstream services will process a given request. - [Gateway Services](https://developer.konghq.com/gateway/entities/service.md): Gateway Services represent the upstream services in your system. These applications are the business logic components of your system responsible for responding to requests. - [SNIs](https://developer.konghq.com/gateway/entities/sni.md): An SNI object represents a many-to-one mapping of hostnames to a certificate. - [Targets](https://developer.konghq.com/gateway/entities/target.md): A Target identifies an instance of an upstream service using an IP address or hostname with a port. - [Upstreams](https://developer.konghq.com/gateway/entities/upstream.md): An Upstream enables load balancing by providing a virtual hostname and collection of Targets (upstream service instances). - [Vaults](https://developer.konghq.com/gateway/entities/vault.md): Vaults allow you to securely store and then reference secrets from within other entities, ensuring that secrets aren't visible in plaintext throughout the platform. - [AWS Secrets Manager vault](https://developer.konghq.com/gateway/entities/vault/aws.md): Use AWS Secrets Manager to store and reference secrets in Kong Gateway. - [Azure Key Vault (Certificates)](https://developer.konghq.com/gateway/entities/vault/azure-certs.md): Use Azure Key Vault to retrieve certificates for Kong Gateway TLS termination. - [Azure Key Vault](https://developer.konghq.com/gateway/entities/vault/azure.md): Use Azure Key Vault to store and reference secrets in Kong Gateway. - [CyberArk Secrets Manager vault](https://developer.konghq.com/gateway/entities/vault/cyberark.md): Use CyberArk Secrets Manager (Conjur) to store and reference secrets in Kong Gateway. - [Environment variable vault](https://developer.konghq.com/gateway/entities/vault/environment-variable.md): Use environment variables on the Kong Gateway data plane to store and reference secrets. - [File system vault](https://developer.konghq.com/gateway/entities/vault/file-system.md): Use the local file system on the Kong Gateway data plane to store and reference secrets. - [Google Cloud Secret Manager vault](https://developer.konghq.com/gateway/entities/vault/google.md): Use Google Cloud Secret Manager to store and reference secrets in Kong Gateway. - [HashiCorp Vault](https://developer.konghq.com/gateway/entities/vault/hashicorp.md): Use HashiCorp Vault to store and reference secrets in Kong Gateway. - [Konnect Config Store vault](https://developer.konghq.com/gateway/entities/vault/konnect-config-store.md): Store and reference secrets natively in Konnect without connecting to a third-party vault backend. - [Workspaces](https://developer.konghq.com/gateway/entities/workspace.md): Workspaces provide a way to segment Kong Gateway entities. Entities in a Workspace are isolated from those in other Workspaces. - [FIPS 140-2 compliance in Kong Gateway](https://developer.konghq.com/gateway/fips-140-2-support.md): Learn about how to enable FIPS mode and how Kong Gateway is FIPS 140-2 compliant. - [FIPS 140-3 compliance in Kong Gateway](https://developer.konghq.com/gateway/fips-support.md): Learn how to enable FIPS mode and how Kong Gateway is FIPS 140-3 compliant. - [Kong Gateway Google Cloud Postgres database authentication with GCP IAM and Workload Identity](https://developer.konghq.com/gateway/gcp-postgres-authentication.md): Learn how to use GCP Identity and Access Management (IAM) and Workload Identity authentication to connect to the Google Cloud Postgres database that you use for Kong Gateway - [Hybrid mode](https://developer.konghq.com/gateway/hybrid-mode.md): Hybrid mode is a deployment model that splits all Kong Gateway nodes in a cluster into Control Planes and Data Plane nodes. - [Incremental configuration sync](https://developer.konghq.com/gateway/incremental-config-sync.md): Use incremental configuration sync to send only the changed entity configuration to Data Plane nodes instead of sending the entire configuration set. - [Install Kong Gateway](https://developer.konghq.com/gateway/install.md): Install Kong Gateway on your preferred platform. - [Keyring](https://developer.konghq.com/gateway/keyring.md): A Keyring is a mechanism that encrypts sensitive data fields, such as consumer secrets, before storing them in the database. This provides for encryption-at-rest security controls in a Kong Gateway cluster. - [Kong Manager](https://developer.konghq.com/gateway/kong-manager.md): Kong Manager is the graphical user interface (GUI) for Kong Gateway. - [Kong Manager configuration](https://developer.konghq.com/gateway/kong-manager/configuration.md): Kong Manager is the graphical user interface (GUI) for Kong Gateway. - [Content Security Policy for Kong Manager](https://developer.konghq.com/gateway/kong-manager/content-security-policy.md): Strengthen security in Kong Manager by setting a Content Security Policy (CSP). - [Kong Manager with LDAP](https://developer.konghq.com/gateway/kong-manager/ldap.md): Bind authentication for Kong Manager admins to an organization’s service directory, and set up authenticated group mapping. - [Kong Manager with OpenID Connect](https://developer.konghq.com/gateway/kong-manager/openid-connect.md): Bind authentication for Kong Manager admins to an organization’s OpenID Connect identity provider, and set up authenticated group mapping. - [Load balancing with Kong Gateway](https://developer.konghq.com/gateway/load-balancing.md): Learn about how Kong Gateway load balances traffic, and what the options are to adjust it. - [Kong Gateway logs](https://developer.konghq.com/gateway/logs.md): See where Kong Gateway logs are located, the different log levels, and how to configure logs and log levels. - [Managing Kong Gateway configuration](https://developer.konghq.com/gateway/manage-kong-conf.md): The Kong Gateway configuration file kong.conf can be used to configure individual properties of your Kong Gateway instance. - [Metrics and monitoring with Kong Gateway](https://developer.konghq.com/gateway/monitoring.md): Learn about how you can monitor Kong Gateway metrics. - [Kong Gateway ports reference](https://developer.konghq.com/gateway/network.md): Learn which ports Kong Gateway uses and how to configure them. - [DNS configuration reference](https://developer.konghq.com/gateway/network/dns-config-reference.md): This reference explains DNS clients, CORS, and cookie management in Kong Gateway. - [Nginx directives](https://developer.konghq.com/gateway/nginx-directives.md): Learn which Nginx directives you can use in the `kong.conf` file and how to adjust them. - [OpenID Connect in Kong Gateway](https://developer.konghq.com/gateway/openid-connect.md): Learn about using OpenID Connect with Kong Gateway. - [PDK](https://developer.konghq.com/gateway/pdk/reference.md) - [kong.client](https://developer.konghq.com/gateway/pdk/reference/kong.client.md) - [kong.client.tls](https://developer.konghq.com/gateway/pdk/reference/kong.client.tls.md) - [kong.cluster](https://developer.konghq.com/gateway/pdk/reference/kong.cluster.md) - [kong.ctx](https://developer.konghq.com/gateway/pdk/reference/kong.ctx.md) - [kong.ip](https://developer.konghq.com/gateway/pdk/reference/kong.ip.md) - [kong.jwe](https://developer.konghq.com/gateway/pdk/reference/kong.jwe.md) - [kong.log](https://developer.konghq.com/gateway/pdk/reference/kong.log.md) - [kong.metrics](https://developer.konghq.com/gateway/pdk/reference/kong.metrics.md) - [kong.nginx](https://developer.konghq.com/gateway/pdk/reference/kong.nginx.md) - [kong.node](https://developer.konghq.com/gateway/pdk/reference/kong.node.md) - [kong.plugin](https://developer.konghq.com/gateway/pdk/reference/kong.plugin.md) - [kong.request](https://developer.konghq.com/gateway/pdk/reference/kong.request.md) - [kong.response](https://developer.konghq.com/gateway/pdk/reference/kong.response.md) - [kong.router](https://developer.konghq.com/gateway/pdk/reference/kong.router.md) - [kong.service](https://developer.konghq.com/gateway/pdk/reference/kong.service.md) - [kong.service.request](https://developer.konghq.com/gateway/pdk/reference/kong.service.request.md) - [kong.service.response](https://developer.konghq.com/gateway/pdk/reference/kong.service.response.md) - [kong.table](https://developer.konghq.com/gateway/pdk/reference/kong.table.md) - [kong.telemetry.log](https://developer.konghq.com/gateway/pdk/reference/kong.telemetry.log.md) - [kong.tracing](https://developer.konghq.com/gateway/pdk/reference/kong.tracing.md) - [kong.vault](https://developer.konghq.com/gateway/pdk/reference/kong.vault.md) - [kong.websocket.client](https://developer.konghq.com/gateway/pdk/reference/kong.websocket.client.md) - [kong.websocket.upstream](https://developer.konghq.com/gateway/pdk/reference/kong.websocket.upstream.md) - [Kong Gateway performance testing benchmarks](https://developer.konghq.com/gateway/performance/benchmarks.md): View Kong's benchmark for the current Kong Gateway version and learn about Kong Gateway performance testing using Kong's test suite. - [Establish a Kong Gateway performance testing benchmark](https://developer.konghq.com/gateway/performance/establish-a-benchmark.md): Establish a benchmark for your Kong Gateway instance. - [Tune Kong Gateway for large payloads](https://developer.konghq.com/gateway/performance/large-payloads.md): How Kong Gateway buffers request and response bodies, and how to tune buffer sizes for deployments handling large payloads. - [Optimize Kong Gateway performance](https://developer.konghq.com/gateway/performance/optimize.md): Review recommendations for improving Kong Gateway performance - [Conditional expressions for plugins](https://developer.konghq.com/gateway/plugins/conditions.md): Reference for the `condition` field, which lets a Kong Gateway plugin run only when a CEL expression matches the request. - [Dynamic plugin config with CEL](https://developer.konghq.com/gateway/plugins/expressible-fields.md): Reference for dynamically setting plugin config fields with CEL expressions in Kong Gateway. - [Conditional expressions for plugins in Kong Gateway 3.14](https://developer.konghq.com/gateway/plugins/expressions-314.md): Use ATC expressions to conditionally control whether a plugin executes on a given request. - [CEL expressions reference](https://developer.konghq.com/gateway/plugins/expressions.md): Reference for the CEL expression language and fields available to plugin conditions and other CEL-driven plugin config in Kong Gateway. - [How legacy dynamic plugin ordering works](https://developer.konghq.com/gateway/plugins/plugin-ordering-legacy.md): A plain-language guide to the `legacy` dynamic plugin ordering algorithm in Kong Gateway — the principle behind it, worked examples, and its pros, cons, and corner cases. - [How priority_preserving dynamic plugin ordering works](https://developer.konghq.com/gateway/plugins/plugin-ordering-priority-preserving.md): A plain-language guide to the opt-in `priority_preserving` dynamic plugin ordering algorithm in Kong Gateway — how it decides an order, how it differs from `legacy`, and how to enable it. - [Kong Gateway PostgreSQL OAuth2 authentication](https://developer.konghq.com/gateway/postgresql-oauth.md): Configure Kong Gateway to authenticate to PostgreSQL using OAUTHBEARER SASL and an OAuth access token. - [PostgreSQL privileges reference](https://developer.konghq.com/gateway/postgresql-privileges-reference.md): Reference for the minimal PostgreSQL privileges Kong Gateway needs for migrations, runtime operations, and admin CLI commands. - [PostgreSQL TLS configuration reference](https://developer.konghq.com/gateway/postgresql-tls-reference.md): Reference for configuring Kong Gateway to use TLS or mTLS when connecting to PostgreSQL. - [Kong Gateway quickstart script reference](https://developer.konghq.com/gateway/quickstart-reference.md): Kong offers a quickstart script that launches a local instance of Kong Gateway for testing. - [Gateway rate limiting](https://developer.konghq.com/gateway/rate-limiting.md): This page is an introduction to rate limiting with Kong Gateway. - [Rate limiting strategies](https://developer.konghq.com/gateway/rate-limiting/strategies.md): This page describes the rate limiting strategies supported by Kong Gateway plugins. - [Rate limiting window types](https://developer.konghq.com/gateway/rate-limiting/window-types.md): This page describes the rate limiting window types supported by Kong Gateway plugins. - [Reserved entity names](https://developer.konghq.com/gateway/reserved-entity-names.md): Reserved and unusable Kong Gateway entity names. - [Kong Gateway resource sizing guidelines](https://developer.konghq.com/gateway/resource-sizing-guidelines.md): Review Kong's recommended resource allocation sizing guidelines for Kong Gateway based on configuration and traffic patterns. - [Expressions router](https://developer.konghq.com/gateway/routing/expressions.md): The expressions router is a collection of Routes that are all evaluated against incoming requests until a match can be found. - [Traditional router](https://developer.konghq.com/gateway/routing/traditional.md): The traditional router is a collection of Routes that are all evaluated against incoming requests until a match can be found. - [Lua sandboxing](https://developer.konghq.com/gateway/sandboxing.md): Reference for Lua sandboxing in Kong Gateway, including available environments and modules for each sandbox mode. - [Kong Gateway software bill of materials](https://developer.konghq.com/gateway/sbom.md): Kong provides a software bill of materials (SBOM) for every minor release, starting with 3.3.0.0. - [Secrets management with Kong Gateway](https://developer.konghq.com/gateway/secrets-management.md): Learn about storing, using, and rotating secrets with Kong Gateway. - [Secure the Admin API](https://developer.konghq.com/gateway/secure-the-admin-api.md): Learn how to secure the Admin API. - [Securing Kong Gateway](https://developer.konghq.com/gateway/security.md): Introduces ways you can secure Kong Gateway - [Using SSL certificates in Kong Gateway](https://developer.konghq.com/gateway/ssl-certificates.md): How to define SSL Certificates and where you can use them. - [Tags](https://developer.konghq.com/gateway/tags.md): Tags are strings associated with entities in Kong Gateway, which you can use to filter entities on most GET endpoints. - [Supported third-party dependencies for Kong Gateway](https://developer.konghq.com/gateway/third-party-support.md): This reference lists all of the tested and supported versions of Kong Gateway's third-party dependencies. - [Data Plane hosting options](https://developer.konghq.com/gateway/topology-hosting-options.md): This page lists the different Data Plane hosting options for different Kong Gateway deployment topologies. - [Kong Gateway tracing](https://developer.konghq.com/gateway/tracing.md): Learn how Kong Gateway tracing works and about the tracing API. - [Traditional mode](https://developer.konghq.com/gateway/traditional-mode.md): Explains how Kong Gateway clustering and caching works in traditional mode. - [Kong Gateway traffic control and routing](https://developer.konghq.com/gateway/traffic-control-and-routing.md): Learn how Kong Gateway listens for, routes, and proxies traffic. - [Blue-green deployments](https://developer.konghq.com/gateway/traffic-control/blue-green-deployments.md): You can set up blue-green deployments for Kong Gateway using Upstreams and Targets, and switching the Gateway Service to point to one Upstream or the other. - [Health check probes](https://developer.konghq.com/gateway/traffic-control/health-check-probes.md): Use health check probes to monitor availability. - [Health checks and circuit breakers](https://developer.konghq.com/gateway/traffic-control/health-checks-circuit-breakers.md): Kong Gateway supports two kinds of health checks, which can be used separately or in conjunction: active and passive (also known as circuit breakers). - [Load balancing in Kong Gateway reference](https://developer.konghq.com/gateway/traffic-control/load-balancing-reference.md): Learn how to load balance requests to upstream services with Kong Gateway - [Proxying with Kong Gateway](https://developer.konghq.com/gateway/traffic-control/proxying.md): Proxying is when Kong Gateway matches an HTTP request with a registered Route and forwards the request. - [Upgrade and migrate Kong Gateway](https://developer.konghq.com/gateway/upgrade.md): Upgrade Kong Gateway to a newer version, or migrate from OSS to Enterprise or from self-managed to Konnect. - [Back up and restore Kong Gateway](https://developer.konghq.com/gateway/upgrade/backup-and-restore.md): Learn how to back up and restore your Kong Gateway data. - [Blue-green upgrade for Kong Gateway](https://developer.konghq.com/gateway/upgrade/blue-green.md): Learn how to perform a blue-green upgrade for Kong Gateway. - [Dual-cluster upgrade for Kong Gateway](https://developer.konghq.com/gateway/upgrade/dual-cluster.md): Learn how to perform a dual-cluster upgrade for Kong Gateway. - [In-place upgrade for Kong Gateway](https://developer.konghq.com/gateway/upgrade/in-place.md): Learn how to perform a in-place upgrade for Kong Gateway. - [Kong Gateway 2.8 to 3.4 LTS upgrade](https://developer.konghq.com/gateway/upgrade/lts-upgrade-28-34.md): This guide walks you through upgrade paths for Kong Gateway 2.8 LTS to 3.4 LTS and helps you prepare for an upgrade. - [Kong Gateway 3.10 to 3.14 LTS upgrade](https://developer.konghq.com/gateway/upgrade/lts-upgrade-310-314.md): This guide walks you through upgrade paths for Kong Gateway 3.10 LTS to 3.14 LTS and helps you prepare for an upgrade. - [Kong Gateway 3.4 to 3.10 LTS upgrade](https://developer.konghq.com/gateway/upgrade/lts-upgrade-34-310.md): This guide walks you through upgrade paths for Kong Gateway 3.4 LTS to 3.10 LTS and helps you prepare for an upgrade. - [Upgrading Kong Gateway](https://developer.konghq.com/gateway/upgrade/reference.md): This guide walks you through upgrade paths for Kong Gateway and helps you prepare for an upgrade. - [Rolling upgrade for Kong Gateway](https://developer.konghq.com/gateway/upgrade/rolling.md): Learn how to perform a rolling upgrade for Kong Gateway. - [Kong Gateway version support policy](https://developer.konghq.com/gateway/version-support-policy.md): The Kong Gateway version support policy outlines the Kong Gateway versioning scheme and version lifecycle, from release to sunset support. - [Kong API Gateway Enterprise vulnerability patching process](https://developer.konghq.com/gateway/vulnerabilities.md): Learn how Kong handles vulnerabilities or potential vulnerabilities in Kong API Gateway Enterprise or third-party code, and how to report any security issues. - [Konnect labels](https://developer.konghq.com/konnect-platform/konnect-labels.md): Learn about labels in Konnect - [Observability Explorer](https://developer.konghq.com/observability/explorer.md): Explorer is an intuitive web-based interface that displays API, LLM, platform, and managed cache usage data gathered by Konnect Analytics. You can use this tool to promptly diagnose performance issues, monitor LLM token consumption and costs, or capture essential usage metrics. - [Kong Gateway Plugins Compatibility](https://developer.konghq.com/plugins/compatibility.md): Plugin compatibility reference with Kong Gateway deployment topologies and Konnect Data Plane hosting options. - [Multi-IdP token validation with OpenID Connect](https://developer.konghq.com/plugins/openid-connect/multi-idp.md): Configure the OpenID Connect plugin to validate tokens from multiple identity providers using a trusted issuer registry or token exchange. - [Apache OpenWhisk](https://developer.konghq.com/plugins/openwhisk.md): Invoke and manage OpenWhisk actions from Kong Gateway - [Wallarm](https://developer.konghq.com/plugins/wallarm.md): Wallarm is AI-Powered Security Platform for protecting microservices and APIs - [Kong premium technology partners](https://developer.konghq.com/premium-partners.md): Kong's premium partners are an ecosystem of premium technology partners that collaborate with Kong on fully-validated integrations for Kong Gateway and the Konnect platform. - [Serverless Gateways](https://developer.konghq.com/serverless-gateways.md): Learn how Serverless Gateways work and how to configure them. - [Migrating a V0 Serverless Gateway to V1](https://developer.konghq.com/serverless-gateways/migration.md): Migrate a V0 Serverless Gateway to V1. - [Serverless Gateway reference](https://developer.konghq.com/serverless-gateways/reference.md): Serverless Gateways are lightweight API gateways. Their control plane is hosted by Konnect and data plane nodes are automatically provisioned. - [After upgrading to Kong 3.10.0.0 I can not log into Kong Manager after making documented changes](https://developer.konghq.com/support/after-upgrading-to-kong-3-6-x-x-i-can-not-log-into-kong-manager-after-making.md): Kong 3.10.x moved Kong Manager session handling to the openid-connect plugin, which can produce a session cookie header larger than Nginx's default proxy buffer, causing login to fail with an upstream error. - [OIDC authenticated group mapping fails when using the `groups` claim with Azure AD](https://developer.konghq.com/support/authenticated-group-mapping-using-groups-claim-using-does-not-work-with-azure-id.md): With Azure AD as the IdP, use the `roles` claim (not `groups`) as the `authenticated_groups_claim` so RBAC role mapping resolves correctly, since the `groups` claim only contains UUIDs. - [Configuring Kong Gateway to output logs as JSON objects](https://developer.konghq.com/support/can-kong-gateway-expose-the-logs-as-json-objects.md): Kong doesn't have a built-in JSON `error_log` format, but JSON access logs can be produced using Kong logging plugins (`tcp-log`, `http-log`) or a custom Nginx `log_format`. - [Code 10 "invalid unique name" error when an entity name matches a reserved Admin API endpoint](https://developer.konghq.com/support/code-10-error-invalid-unique-name.md): This error is returned because of a pre-existing Admin API endpoint named 'auth'. - [HTTP 413 "Configuration does not fit in LMDB database" error when pushing config to data planes](https://developer.konghq.com/support/configuration-does-not-fit-in-lmdb-database-error.md): Pushing configuration to data planes fails with an HTTP 413 "Configuration does not fit in LMDB database" error; raise `lmdb_map_size` to fix it. - [Configure Kong to handle public key rotation for consumer credentials without hardcoding the public key](https://developer.konghq.com/support/configure-kong-to-handle-public-key-rotation-for-consumer-credentials-without-hardcoding-the-public-key.md): The JWT plugin in Kong requires the public key to be uploaded for JWT validation. - ["Consumer was not found with access token" error when the OIDC `consumer_claim` is missing from the token](https://developer.konghq.com/support/consumer-was-not-found-with-access-token-claim-email-was-not-found-for-consumer-mapping.md): This occurs when the claim defined in the OIDC `consumer_claim` field is not found in the token provided. - [Controlling the hybrid configuration update frequency](https://developer.konghq.com/support/controlling-the-hybrid-configuration-update-frequency.md): How the `db_update_frequency` parameter controls how often Kong Gateway pushes configuration updates from the Control Plane to Data Planes in Hybrid mode. - ["Database already bootstrapped" messages when upgrading Kong with Helm](https://developer.konghq.com/support/database-already-bootstrapped-messages-when-upgrading-kong-with-helm.md): Reinstalling (rather than upgrading) the Kong Helm chart causes the init-migrations job to report "Database already bootstrapped" because the database has already been bootstrapped by a prior install; follow the Helm upgrade procedure instead. - [Deck session cookies are not valid for the configured lifetime](https://developer.konghq.com/support/deck-session-cookies-are-not-valid-for-the-configured-lifetime.md): The session cookie used by `deck ping` expires before the configured `cookie_lifetime`; increasing `cookie_discard` keeps the original cookie valid for its full lifetime. - [DNS resolution failed when setting `http_proxy` for the OpenID Connect plugin behind a proxy](https://developer.konghq.com/support/dns-resolution-failed-when-setting-http-proxy-for-openid-connect-plugin-behind-proxy.md): The `config.http_proxy` and `config.https_proxy` parameters refer to the protocol of the IdP's URL, not the protocol between Kong and the proxy. - [TLS v1.3 support for connecting to Upstreams in Kong](https://developer.konghq.com/support/do-upstreams-in-kong-support-tls-v1-3.md): Support for Upstream TLS v1.3 is possible but is not enabled by default. - [http2 protocol support for client connections in Kong](https://developer.konghq.com/support/does-kong-support-http2-protocol.md): Kong supports http2 client connections through nginx: by default over TLS ports and via HTTP/2 prior knowledge on plain ports. - [Enabling LDAP for Kong Manager failed with an error; invalid primary key: '{id="expected a valid UUID"}'](https://developer.konghq.com/support/enabling-ldap-for-kong-manager-failed-with-an-error-invalid-primary-key-id-expected-a-valid-uuid.md): LDAP authentication for Kong Manager fails with an `invalid primary key` error when the LDAP user falls back to the anonymous consumer, which Kong Manager doesn't permit. - [Error: nginx_kong.lua:9: '=' expected near 'customformat' when using a custom log_format](https://developer.konghq.com/support/error-nginx-kong-lua-9-expected-near-customformat-when-using-a-custom-log-format.md): This can occur when attempting to use `log_format` outside the HTTP context. - [Error: require "resty.http" not allowed within sandbox](https://developer.konghq.com/support/error-require-resty-http-not-allowed-within-sandbox.md): Plugins that execute arbitrary Lua code run in a sandbox that blocks require of certain modules; allow the module or disable the sandbox to resolve it. - ["failed to get from node cache: invalid status code received from the userinfo endpoint (400)" error when using the OpenID Connect plugin with Azure AD](https://developer.konghq.com/support/failed-to-get-from-node-cache-invalid-status-code-received-from-the-userinfo-endpoint-400.md): Kong rejects Azure AD access tokens with a `userinfo` endpoint 400 error when the token's `iss` claim doesn't match the issuer configured in the OpenID Connect plugin. - [Kong Gateway FAQs](https://developer.konghq.com/support/gateway-faqs.md): Answers to common questions about Kong Gateway plugins, workspaces, custom plugin caching, and DNS resolver configuration. - ["API route collides with an existing API" error when creating a route in a different workspace](https://developer.konghq.com/support/getting-error-api-route-collides-with-an-existing-api.md): Kong Gateway Enterprise's route collision check warns when a new route in one workspace could unintentionally take traffic from a route in another workspace. Disable the check or reorder route creation to avoid it. - [Getting "[PostgreSQL error] failed to retrieve PostgreSQL server_version_num: the server does not support SSL connections" error when connecting to PostgreSQL](https://developer.konghq.com/support/getting-postgresql-error-failed-to-retrieve-postgresql-server-version-num-the-server-does-not-support-ssl-connections-error-when-connecting-to-postgres.md): PostgreSQL must have SSL enabled in `postgresql.conf` before Kong can make a TLS connection to it. - [Creating a consumer credential with the Admin API](https://developer.konghq.com/support/how-can-a-consumer-credential-be-created-with-the-admin-api.md): How to create basic-auth and key-auth consumer credentials directly through the Kong Admin API instead of Kong Manager. - [Deleting a consumer credential with the Admin API](https://developer.konghq.com/support/how-can-a-consumer-credential-be-deleted-with-the-admin-api.md): How to delete a consumer credential (basic-auth, key-auth, ACL, HMAC, JWT, or OAuth 2.0) using the Kong Admin API DELETE endpoint. - [Installing custom dependencies in Kong Docker images](https://developer.konghq.com/support/how-can-custom-dependencies-be-installed-in-kong-images.md): Extend the standard Kong Docker image with a custom `Dockerfile` to install additional CLI tools and Lua libraries for a custom plugin. - [Enabling streaming of responses with `text/event-stream` content-types instead of buffering them into one large payload](https://developer.konghq.com/support/how-can-i-enable-streaming-of-responses-with-text-event-stream-content-types-instead-of-having-the-responses-buffered-and-sent-in-one-large-payload.md): To stream responses with the `text/event-stream` content type instead of having them buffered, disable response body buffering on the specific route by setting `response_buffering` to `false`. - [Increasing the connect timeout using the Serverless Functions plugin](https://developer.konghq.com/support/how-can-i-increase-the-connect-timeout-using-the-serverless-functions-plugin.md): Override Kong's `connect_timeout` to the upstream using a Lua snippet in the Serverless (pre-function) plugin's `config.access` phase. - [How can I insert a field from the request body into the header for rate limiting?](https://developer.konghq.com/support/how-can-i-insert-a-field-from-the-request-body-into-the-header-for-rate-limiting-purposes-in-kong.md): Use the Pre-Function plugin with the Kong Gateway PDK to extract a field from the request body and insert it into a request header so you can rate limit on that field. - [Configuring Kong to use Azure Key Vaults with Managed Identities authentication](https://developer.konghq.com/support/how-can-kong-be-configured-to-use-azure-key-vaults-with-managed-identities-authentication.md): Set up a Managed Identity in Azure, assign it to the Kong VM or AKS instance, grant it access in Key Vault, and configure `AZURE_CLIENT_ID` and `KONG_VAULT_AZURE_VAULT_URI` so Kong can authenticate to Azure Key Vault without explicit credentials. - [Using local files to sign JWT tokens and the required key format](https://developer.konghq.com/support/how-can-local-files-be-used-to-sign-jwt-tokens-and-what-format-must-the-keys-be-in.md): The `jwt-plugin`'s keyset parameters only support loading keys from an http(s) endpoint, so local key files must be served through a custom nginx endpoint instead. - [Resetting the Admin API RBAC token programmatically](https://developer.konghq.com/support/how-can-the-admin-api-rbac-token-be-reset-programmatically.md): Reset the Admin API RBAC token programmatically by authenticating to get a Kong Manager session cookie and using it to call the `/admins/self/token` endpoint. - [Showing Authorization headers in the Kong log plugins](https://developer.konghq.com/support/how-can-the-authorization-headers-be-shown-in-the-kong-log-plugins.md): Log plugins redact the Authorization header by default; use `custom_fields_by_lua` to log its value to a separate field for debugging. - [Validating the Kong declarative config file in db-less mode](https://developer.konghq.com/support/how-can-the-kong-declarative-config-file-be-validated-in-db-less-mode.md): The Kong binary can be used to validate a config for problems prior to loading using the `config parse` command. - [How to accurately calculate upstream target weights for traffic distribution](https://developer.konghq.com/support/how-to-accurately-calculate-upstream-target-weights-for-traffic-distribution.md): How Kong's upstream load balancer treats each IP address returned by a DNS A record as a separate weighted target, and how to calculate weights so traffic is distributed as intended. - [How to add an additional port for the Kong proxy](https://developer.konghq.com/support/how-to-add-additional-port-for-the-proxy.md): Add an additional port for the Kong proxy by setting `proxy_listen` in `kong.conf` or the `KONG_PROXY_LISTEN` environment variable. - [How to add status code to tracing spans with the OpenTelemetry plugin](https://developer.konghq.com/support/how-to-add-status-code-to-tracing-spans-with-opentelemetry-plugin.md): Add a `pre-function` plugin that sets the `http.status_code` attribute on the OpenTelemetry root tracing span, since the OpenTelemetry plugin doesn't include it by default. - [How to allow anonymous access to a route using the OIDC plugin](https://developer.konghq.com/support/how-to-allow-anonymous-access-to-a-route-using-the-oidc-plugin.md): Configure the OpenID Connect plugin's anonymous consumer so that requests without a valid token fall through to an anonymous consumer instead of being rejected. - [Auditing Route configuration changes using the Kong audit log API](https://developer.konghq.com/support/how-to-audit-route-configuration-changes-via-kong-audit-log-apis.md): Use the Kong Gateway audit log APIs to trace who changed a Route and to detect Routes created with empty or missing paths. - [How to avoid the OpenID Connect plugin obtaining a token from cache that is almost expired](https://developer.konghq.com/support/how-to-avoid-openid-connect-plugin-obtain-a-token-from-cache-that-is-almost-expired.md): Explains how to set `config.cache_ttl_max` on the OpenID Connect plugin so Kong requests a new access token before the cached token expires. - [How to check DNS querying when Kong is installed in k8s](https://developer.konghq.com/support/how-to-check-dns-querying-when-installed-kong-in-k8s.md): Explains how to inspect the DNS queries Kong makes in Kubernetes by enabling query logging in the cluster's CoreDNS configuration. - [How to configure a certificate key with Secrets Management and the Environment Variable backend](https://developer.konghq.com/support/how-to-configure-a-certificate-key-with-secret-management-and-environment-variable-backend.md): When referencing a certificate key from an environment variable with Kong's Secrets Management feature, set the certificate's `key` field to `{vault://env/}` in your declarative configuration. - [How to configure a Kong service to perform upstream MTLS](https://developer.konghq.com/support/how-to-configure-a-kong-service-to-perform-upstream-mtls.md): Configure a Kong service for upstream MTLS by setting a client certificate and CA certificate at the service level or globally. - [How do I configure rate limiting on Consumer Groups?](https://developer.konghq.com/support/how-to-configure-consumer-groups-rate-limiting-policy-after-upgrading-to-latest-kong-version.md): After upgrading Kong Gateway, use the recommended method for configuring rate limiting on Consumer Groups: scope the Rate Limiting plugin directly to the Consumer Group. - [Configuring the Kong AWS Lambda plugin to return the same 4xx status codes sent by an AWS Lambda function back to the client](https://developer.konghq.com/support/how-to-configure-kong-aws-lambda-plugin-to-return-the-same-4xx-status-codes-sent-by-an-aws-lambda-function-back-to-the-client.md): Explains how to enable `is_proxy_integration` on the Kong AWS Lambda plugin so it returns the same status codes sent by the AWS Lambda function to the client. - [How to configure rate limiting by consumer from the openid-connect plugin](https://developer.konghq.com/support/how-to-configure-rate-limiting-by-consumer-from-the-openid-connect-plugin.md): Configure rate limiting by consumer from the openid-connect plugin using `config.credential_claim` without mapping consumers in Kong. - [How to create a Kong Manager and RBAC user via Admin API](https://developer.konghq.com/support/how-to-create-a-kong-manager-and-rbac-user-via-admin-api.md): Explains how to create a Kong Manager admin user, assign it the `super-admin` RBAC role, and activate it entirely through the Admin API using an existing RBAC token. - [How to create a new admin without Kong Manager](https://developer.konghq.com/support/how-to-create-a-new-admin-without-kong-manager.md): Provides a bash script that creates a new Kong Manager admin, sets their password, and generates an RBAC token, all via the Admin API. - [How to create global plugins when converting OpenAPI spec to declarative Kong config](https://developer.konghq.com/support/how-to-create-global-plugins-when-converting-openapi-spec-to-declarative-kong-config.md): The `x-kong-plugin` extension only adds plugins at the service level, so global plugins must be added manually to the declarative config after conversion. - [How to customize a plugin response to make it more meaningful](https://developer.konghq.com/support/how-to-customise-a-plugin-response-to-make-it-more-meaningful.md): Use the `exit-transformer` plugin to append meaningful messages to plugin responses based on the HTTP status code returned by Kong. - [How to customize Kong access logs](https://developer.konghq.com/support/how-to-customize-kong-access-logs.md): Explains how to write a custom Nginx template with a `map` block so Kong's access log skips 2xx and 3xx requests. - [How to debug the Control Plane/DataPlane web socket communication](https://developer.konghq.com/support/how-to-debug-the-control-plane-dataplane-web-socket-communication.md): Use stunnel to terminate TLS on the Control Plane/Data Plane WebSocket connection and tcpdump to capture the resulting plaintext traffic, so you can inspect the declarative configuration payload sent over `cluster_listen`. - [How do I define RBAC endpoint permissions across every Workspace?](https://developer.konghq.com/support/how-to-define-custom-rbac-endpoint-permissions-across-all-workspaces.md): Because Kong Manager omits the Workspace from RBAC endpoint permission requests, call the Admin API directly with the Workspace key set to * to apply a custom endpoint permission across all Workspaces. - [How to deploy multiple custom plugins in Kong in Docker](https://developer.konghq.com/support/how-to-deploy-multiple-custom-plugins-in-kong-in-docker.md): Deploy multiple custom plugins in a Dockerized Kong by mounting them outside the standard plugins directory and configuring `lua_package_path` and `KONG_PLUGINS`. - [How to determine and test which AWS subnets service Kong's S3 buckets.](https://developer.konghq.com/support/how-to-determine-and-test-which-aws-subnets-service-kongs-s3-buckets.md): Use AWS's published IP range list and `jq` to determine which subnets serve a Kong S3 bucket in a given region. - [How to disable SSL ciphers in Kong-Gateway Proxy](https://developer.konghq.com/support/how-to-disable-ssl-chipers.md): Configure Kong's `ssl_cipher_suite` and `ssl_ciphers` settings to enable only the SSL/TLS ciphers you want, instead of disabling the ones you don't. - [How to disable the x-forwarded-x headers from a single route](https://developer.konghq.com/support/how-to-disable-the-x-forwarded-x-headers-from-a-single-route.md): Explains how to use the `post-function` plugin to disable specific `X-Forwarded-*` headers, such as `x-forwarded-proto` or `x-forwarded-host`, on a single route. - [How to enable Data Plane Resilience when using Helm](https://developer.konghq.com/support/how-to-enable-data-plane-resilience-when-using-helm.md): How to achieve Data Plane Resilience with the Kong Helm chart by separating the config-exporter data plane from the data plane that proxies traffic. - [How to enable debug log](https://developer.konghq.com/support/how-to-enable-debug-log.md): There are multiple ways to change Kong's log level depending on your deployment method: config file, environment variable, Kubernetes, Helm, or dynamically without a restart. - [How to enable debug logging for kuma sidecar without using port-forward](https://developer.konghq.com/support/how-to-enable-debug-logging-for-kuma-sidecar-without-using-port-forward.md): Steps to enable debug logging on the kuma sidecar by logging in to the container and sending an HTTP POST request to its admin API with the `wget` command. - [Enable OCSP stapling and handle OCSP server downtime](https://developer.konghq.com/support/how-to-enable-ocsp-stapling-in-kong-and-handle-ocsp-server-downtime.md): Configure OCSP Stapling in Kong Gateway with the relevant NGINX environment variables, and understand how Kong Gateway behaves when the OCSP responder is unavailable. - [How to enable response compression using gzip](https://developer.konghq.com/support/how-to-enable-response-compression-using-gzip.md): Enable gzip response compression in Kong by setting the nginx `gzip` directives (`nginx_proxy_gzip`, `nginx_proxy_gzip_proxied`, `nginx_proxy_gzip_types`) in `kong.conf` or as `KONG_NGINX_PROXY_GZIP*` environment variables. - [How to enforce strict JSON body schemas when using the OAS Validation plugin](https://developer.konghq.com/support/how-to-enforce-strict-json-body-schemas-when-using-the-oas-validation-plugin.md): Set the additionalProperties field to false in your OAS body schema to reject request bodies that contain keys not defined in the schema. - [How to expose Kong metrics with Prometheus in K8s](https://developer.konghq.com/support/how-to-expose-kong-metrics-with-prometheus-in-k8s.md): Install Prometheus and configure a Kong Helm deployment with `serviceMonitor.enabled: true` so the Prometheus Operator can scrape Kong's metrics endpoint. - [How to fake down `/status` endpoint](https://developer.konghq.com/support/how-to-fake-down-status-endpoint.md): Simulate the `/status` endpoint going down on a standalone Kong node by looping it back through an upstream and marking the target unhealthy via the Admin API. - [How to force a login into the IdP after logging out of Kong Manager](https://developer.konghq.com/support/how-to-force-a-login-into-the-idp-after-logging-out-of-kong-manager.md): Add `authorization_query_args_names` and `authorization_query_args_values` to your `admin_gui_auth_config` (or `KONG_ADMIN_GUI_AUTH_CONF`) to force a login into your IdP after logging out of Kong Manager. - [how to get id token and access token used for Kong Manager or Dev Portal login](https://developer.konghq.com/support/how-to-get-id-token-and-access-token-used-for-kong-manager-or-dev-portal-login.md): Configure `downstream_id_token_header` and `downstream_access_token_header` in the OpenID Connect config, then inspect the browser's network tab to find the id token and access token used for Kong Manager or Dev Portal login. - [How to get the Exit Transformer to return a null in the response body](https://developer.konghq.com/support/how-to-get-the-exit-transformer-to-return-a-null-in-the-response-body.md): Configure the Exit Transformer plugin to return a field with a null value in the response body by updating the untrusted Lua environment variables and using cjson.null. - [How to get the time when Kong Gateway sends a request to upstream and receives a response](https://developer.konghq.com/support/how-to-get-the-time-when-kong-send-request-to-upstream-and-the-time-kong-get-whole-response-from-upstream.md): Use the Pre-Function and Post-Function plugins to log the time Kong Gateway sends a request to upstream and the time Kong Gateway receives the whole response. - [How to implement guard logic for buffered proxying and body existence in serverless plugins](https://developer.konghq.com/support/how-to-implement-guard-logic-for-buffering-and-body-existence-in-serverless-plugins.md): Add guard logic to a `pre-function` plugin that checks `ngx.ctx.buffered_proxying` and confirms the request or response body is non-nil before serializing it, to prevent errors from nil bodies or disabled buffering. - [How to import a certificate object from environment variables to Kong by using the secret management function](https://developer.konghq.com/support/how-to-import-certificate-object-from-environment-variables-to-kong-by-using-secret-management-function.md): Export your certificate and private key as environment variables (e.g. `MY_SECRET_CERT` and `MY_SECRET_KEY`), then reference them with the `{vault://env/...}` syntax when creating a certificate object in Kong. - [How to inject the same nginx directive with multiple different values](https://developer.konghq.com/support/how-to-inject-the-same-nginx-directive-with-multiple-different-values.md): Kong doesn't support specifying the same NGINX directive multiple times with different values, but you can work around this by defining multiple complete directive values in a single config property. - [How to log response body and upstream by using pre-function plugin](https://developer.konghq.com/support/how-to-log-response-body-and-upstream-by-using-pre-function-plugin.md): Use the pre-function plugin to log the response body and the resolved upstream for a service. - [How to proxy request to a specific upstream path when the upstream root path already exists by using `request-transformer` plugin](https://developer.konghq.com/support/how-to-proxy-request-to-a-specific-upstream-path-when-the-upstream-root-path-already-exists.md): This article shows how to create a dynamic route path by using the `request-transformer` plugin. - [How to proxy SOAP requests in Kong](https://developer.konghq.com/support/how-to-proxy-soap-requests-in-kong.md): Kong proxies SOAP requests like any other HTTP request, but proxying an HTTPS SOAP upstream requires uploading the full CA certificate chain to Kong's `ca_certificates` entity. - [How to recreate `kong_admin` user](https://developer.konghq.com/support/how-to-recreate-kong-admin-user.md): How to recreate a deleted `kong_admin` super admin user, either through another existing super admin or by temporarily disabling RBAC. - [How to recreate the default roles in the default workspace if accidentally deleted](https://developer.konghq.com/support/how-to-recreate-the-default-roles-in-the-default-workspace-after-they-got-deleted-by-mistake.md): How to recreate Kong's three default RBAC roles (`super-admin`, `admin`, `read-only`) in the default workspace after they've been accidentally deleted. - [How to redirect routes based on existence of a header](https://developer.konghq.com/support/how-to-redirect-routes-based-on-existence-of-a-header.md): Use a Request Termination plugin and an Exit Transformer plugin to redirect requests to different routes based on whether a header like `x-vendor` is present. - [How to reference a JSON or YAML config file in a deck config YAML](https://developer.konghq.com/support/how-to-reference-a-json-or-yaml-config-file-in-a-deck-config-yaml.md): As it stands, decK does not offer the ability to reference JSON or YAML files from the filesystem in its config. - [How to reset password by 'Reset Password' link without SMTP server](https://developer.konghq.com/support/how-to-reset-password-by-reset-password-link-without-smtp-server.md): This article explains how to reset an admin or RBAC user's password using the Reset Password link when no SMTP server is configured. - [How to reset RBAC token for an Admin using the CLI](https://developer.konghq.com/support/how-to-reset-rbac-token-for-an-admin-using-the-cli.md): The following script takes a username and password, converts it to a session, which is then used to log in to the `admin-api` and retrieve a new RBAC token for the authenticating admin. - [Resolving Connection Reset Errors When Configuring Kong Audit Logs with Webhooks and Splunk](https://developer.konghq.com/support/how-to-resolve-connection-reset-errors-when-configuring-kong-audit-logs-with-webhooks-and-splunk.md): Webhook requests to Splunk can fail with a `"connection reset by peer"` error; allowlisting Kong Konnect's egress IP addresses on the Splunk side typically resolves it. - [How to route requests regarding incoming request port number](https://developer.konghq.com/support/how-to-route-requests-regarding-incoming-request-port-number.md): Kong doesn't route requests based on the incoming port natively, so this article uses the `pre-function` plugin to proxy requests to different upstreams by port number. - [How to send Kong log to Splunk by using HTTP Log plugin](https://developer.konghq.com/support/how-to-send-kong-log-to-splunk-by-using-http-log-plugin.md): Configure the HTTP Log plugin to send Kong logs to a Splunk HTTP Event Collector (HEC) raw endpoint using a secure token. - [How to set healthcheck in ALB for Kong control plane when it's enabled with RBAC](https://developer.konghq.com/support/how-to-set-healthcheck-in-alb-for-kong-control-plane-when-it-enabled-with-rbac.md): After enabling RBAC for the Kong control plane (CP), its admin port (`8001`/`8444`) will always return `401` if no token has been sent. - [How to set up a maintenance page inside Kong Gateway](https://developer.konghq.com/support/how-to-set-up-a-maintenance-page-inside-kong-gateway.md): Learn how to display a maintenance page in Kong Gateway using the Request Termination plugin to return a custom message and content type. - [How to set up kong to autostart kong with systemd with a non root user](https://developer.konghq.com/support/how-to-set-up-kong-to-autostart-kong-with-systemd-with-a-non-root-user.md): How to configure systemd to run Kong Gateway as a non-root `kong` user on RHEL and CentOS 8, instead of root. - [How to setup a PKI Hybrid instance in Kubernetes with certificate manager](https://developer.konghq.com/support/how-to-setup-a-pki-hybrid-instance-in-kubernetes-with-certificate-manager.md): How to configure Kong Gateway Hybrid mode to use PKI mutual TLS with certificates issued by cert-manager and a private CA in Kubernetes. - [How to setup self-signed intermediate certificates in Kong hybrid model](https://developer.konghq.com/support/how-to-setup-self-signed-ca-in-kong-hybrid-model.md): Environment variable configuration for Kong Gateway hybrid mode control planes and data planes using self-signed intermediate CA certificates, plus fixes for related TLS handshake and certificate verification errors. - [How to solve OIDC error unable to verify digest](https://developer.konghq.com/support/how-to-solve-oidc-error-unable-to-verify-digest.md): The `unable to RSA SHA256 verify digest` error appears when Kong cannot verify the signature of an access token, typically when using MS Azure AD (directly, or as a federated store behind Okta). - ["upstream sent too big header while reading response header from upstream" error when response headers exceed the Nginx proxy buffer size in Kong Gateway](https://developer.konghq.com/support/how-to-solve-upstream-sent-too-big-header-while-reading-response-header-from-upstream-problem.md): These logs will be written when the headers sent by the upstream are too large for the Nginx proxy buffer size set in the Nginx layer in Kong Gateway. - [How to upload a PFX-format certificate to Kong](https://developer.konghq.com/support/how-to-upload-pfx-format-certificate-to-kong.md): Convert a PFX certificate to separate PEM certificate and key files, then upload them to Kong via Kong Manager or the Admin API. - [How to use a custom environment variable in a custom plugin or serverless-functions plugin when Kong is installed via a Helm chart](https://developer.konghq.com/support/how-to-use-custom-environment-variable-in-custom-plugin-or-serverless-functions-plugin-when-installed-kong-via-helm-chart.md): Use the `kong.vault.get()` method to load a custom environment variable set via a Helm chart's `customEnv` values into a custom or serverless-functions plugin. - [How to Use External Lua Scripts with the `pre-function` Plugin in declarative config](https://developer.konghq.com/support/how-to-use-external-lua-scripts-with-the-pre-function-plugin-in-declarative-config.md): While Kong DecK does not support referencing external files directly, you can achieve your goal by using environment variables to include the content of your Lua script. - [How to use TLS-enabled Redis as a strategy for the `rate-limiting-advanced` plugin](https://developer.konghq.com/support/how-to-use-redis-tls.md): Set up a TLS-enabled Redis instance and configure it as the strategy for the `rate-limiting-advanced` plugin, including sharing one Redis instance across multiple Kong nodes. - [How to use the `decK` docker container](https://developer.konghq.com/support/how-to-use-the-deck-with-container.md): Use the `decK` Docker container to dump, sync, reset, and validate Kong declarative configuration against a running Kong Admin API. - [How to use the relevant parameters for refresh token authentication method in the `openid-connect` plugin](https://developer.konghq.com/support/how-to-use-the-relevant-paramters-for-refresh-token-authentication-method-in-the-openid-connect-plugin.md): The `refresh_token_param_type` parameter determines where Kong will look for the refresh token in an incoming request. - [How to use the route-transformer-advanced plugin to modify only part of the path](https://developer.konghq.com/support/how-to-use-the-route-transformer-advanced-plugin-to-modify-only-part-of-the-path.md): The `route-transformer-advanced` plugin allows you to use any of the current request headers, query parameters, and captured URI groups as templates to populate supported config fields. - [how to use request validator plugin to validate whether a custom header is equal to an integer](https://developer.konghq.com/support/how-to-validate-a-custom-header-equal-to-integer.md): Use the `request-validator` plugin's `parameter_schema` to require a custom header value to match a specific integer, then apply the plugin to a route through the Admin API. - [How to view the contents of shared dictionaries](https://developer.konghq.com/support/how-to-view-the-contents-of-shared-dictionaries.md): Use a pre-function plugin to report the contents of the SHM LRU dictionaries in Kong. - [HTTP 499 error responses when Kong is behind a CDN and using SSE](https://developer.konghq.com/support/http-499-error-responses-when-kong-is-behind-a-cdn-and-using-sse.md): HTTP error 499 means that the client closed the connection in the middle of processing the request through the server or before the server answered the request. - ["Invalid credentials" error in Kong Manager after authenticating user in external IDP](https://developer.konghq.com/support/invalid-credentials-error-in-kong-manager-after-authenticating-user-in-external-idp.md): An incorrect `admin_claim` configuration — not `consumer_claim` — causes Kong Manager to reject OIDC logins even after the external IdP authenticates successfully. - [Sending notifications when a Kong session is created using Event Hooks](https://developer.konghq.com/support/is-it-possible-for-kong-to-notify-when-an-session-is-created.md): You can use Kong Event Hooks to send notifications to a webhook endpoint. - [Keeping Kong Functional During DB Down Times](https://developer.konghq.com/support/keeping-kong-functional-during-db-down-times.md): Configure database cache TTLs, warmup entities, and memory settings so Kong Gateway keeps proxying during database maintenance or downtime. - [Kong AI Gateway: "ERROR: expected 512 dimensions, not 1024" when using `ai-semantic-cache`](https://developer.konghq.com/support/kong-ai-gateway-error-expected-512-dimensions-not-1024-when-using-ai-semantic-cache.md): Switching embedding models to a different dimension size after the `ai-semantic-cache` plugin's vector table was created causes a Postgres dimension-mismatch error in the background cache-store logs. - [Kong decK: When deploying multiple files at once, global `select_tags` are applied to all resources](https://developer.konghq.com/support/kong-deck-when-deploying-multiple-files-at-once-global-select-tags-are-applied-to-all-resources.md): Both resources are applying the global tags values as they are being applied at the same time. - [Kong fails to start with the error "password authentication failed for user"](https://developer.konghq.com/support/kong-fails-to-start-with-the-error-password-authentication-failed-for-user.md): A hash mark (`#`) in a Postgres password set via `kong.conf` gets truncated as a comment, causing Kong to fail to start with a password authentication error. - [Kong Gateway: 401 HTTP response and "unable to verify digest" error seen after updating signing certificate in IdP](https://developer.konghq.com/support/kong-gateway-401-http-response-and-unable-to-verify-digest-error-seen-after-updating-signing-certificate-in-idp.md): When the Kong OIDC plugin throws a 401 error following an update to the IDP signer certificate, it is typically due to the plugin's cache not being updated with the new certificate information. - [Kong Gateway: AI Proxy "content-type header does not match request body"](https://developer.konghq.com/support/kong-gateway-ai-proxy-content-type-header-does-not-match-request-body.md): Explains why the AI Proxy plugin's `content-type header does not match request body` error is dead code in current Kong Gateway releases, and how to resolve the `request body doesn't contain valid inputs` error that replaced it. - [Kong Gateway: Auth0 IDP returns invalid bearer token when using with consumer claim](https://developer.konghq.com/support/kong-gateway-auth0-idp-returns-invalid-bearer-token-when-using-with-consumer-claim.md): This happens specifically with Auth0 when there is no audience specified with the OIDC configuration. - [Error connecting Kong Gateway to PostgreSQL](https://developer.konghq.com/support/kong-gateway-error-connecting-kong-to-postgresql-failed-to-retrieve-postgresql-server-version-num-fatal-no-pg-hba-conf-entry-ssl-off.md): This error occurs when Kong connects to the PostgreSQL DB server without SSL, but the server requires SSL connections. - [Kong Gateway: Error: "data_plane.lua:365: [clustering] unable to update running config: no memory" DP won't sync](https://developer.konghq.com/support/kong-gateway-error-data-plane-lua-365-clustering-unable-to-update-running-config-no-memory-dp-won-t-sync.md): When the dataplane fails to sync it will throw a message of "unable to update running config: xyz". - [Kong Gateway: "could not find cached values" error with the environment variables vault backend](https://developer.konghq.com/support/kong-gateway-error-with-environment-variables-vault-could-not-find-cached-values.md): The "could not find cached values" error appears when a vault reference for the environment variables (`env`) vault backend can't resolve, often due to a mismatched `KONG_VAULT_ENV_PREFIX` or a lowercase environment variable name. - ["[file-log] failed to open the file: Permission denied" error when logging to /dev/stdout as a non-root user](https://developer.konghq.com/support/kong-gateway-file-log-failed-to-open-the-file-permission-denied-while-logging-request-dev-stdout.md): Explains why the file-log plugin returns a Permission denied error when logging to `/dev/stdout`, and how to fix it by keeping the container running as the `kong` user instead of root. - [Error: 'Invalid Nginx Configuration' when enabling nginx_proxy_brotli in kong.conf](https://developer.konghq.com/support/kong-gateway-fixing-invalid-nginx-configuration-error-when-enabling-nginx-proxy-brotli-in-kong-conf.md): When configuring `nginx_proxy_brotli` in your `kong.conf` file, you might encounter an error that prevents successful deployment, stating that the Nginx configuration is invalid. - [Kong Gateway: Graceful Shutdown of Kong in ECS not working](https://developer.konghq.com/support/kong-gateway-graceful-shutdown-of-kong-in-ecs-not-working.md): Kong's master process runs as PID 1 in ECS tasks, so ECS sends SIGTERM directly to it instead of honoring the container's `STOPSIGNAL`, causing in-flight requests to fail. Using an init process such as `dumb-init` enables a graceful shutdown. - [Kong Gateway: Host header case-sensitive on Routes for route matching, causing HTTP 404 errors](https://developer.konghq.com/support/kong-gateway-host-header-case-sensitive-on-routes-for-route-matching-causing-http-404-errors.md): Host header matching on Kong Gateway Routes is case-sensitive, per RFC, even though header names are case-insensitive, so requests with a different-case Host header (e.g. `Example.com` vs. `example.com`) return a 404. - [How to retain the browser Cookie header when forwarding requests through the Post-Function plugin](https://developer.konghq.com/support/kong-gateway-how-can-i-ensure-that-a-request-forwarded-through-a-kong-post-function-plugin-retains-the-cookie-passed-from-the-browser.md): When a request is forwarded through a Post-Function plugin, the browser Cookie header may not be retained. Use Pre-Function and Post-Function plugins with kong.ctx.shared to capture and forward the Cookie header. - [View the request Kong Gateway receives on demand using the Request Termination plugin](https://developer.konghq.com/support/kong-gateway-how-can-i-see-the-request-kong-receives-on-demand.md): Use the Request Termination plugin's `config.echo` and `config.trigger` settings to echo back the full request — headers, body, and matched route/service — on demand for a single request. - [Adding headers stored as a secret with the Request Transformer Advanced plugin](https://developer.konghq.com/support/kong-gateway-how-can-i-use-the-request-transformer-advanced-plugin-to-add-headers-stored-as-a-secret.md): Store a header's `value` (not the whole `headerName:headerValue` pair) as the secret when using Secrets Management with the Request Transformer Advanced plugin, to avoid the header name getting URL-encoded. - [Kong Gateway: How to configure AWS Lambda plugin when doing cross-account function invocation](https://developer.konghq.com/support/kong-gateway-how-to-configure-aws-lambda-plugin-when-doing-cross-account-function-invocation.md): Covers the AWS IAM role and `aws-lambda` plugin misconfigurations that cause cross-account AWS Lambda invocation errors in Kong Gateway, and how to correctly set up role assumption using the `aws_assume_role_arn` field. - [Kong Gateway: How to get Correlation ID inside the Access Phase when using Correlation ID Plugin](https://developer.konghq.com/support/kong-gateway-how-to-get-correlation-id-inside-the-access-phase-when-using-correlation-id-plugin.md): Whether a custom or pre-function plugin can read the Correlation ID generated by the Correlation ID plugin during the Access phase depends on plugin execution priority — in Kong Gateway Enterprise, use a `post-function` plugin, which runs after the Correlation ID plugin. - [Kong Gateway: How to rate limit OAuth2 token endpoint](https://developer.konghq.com/support/kong-gateway-how-to-rate-limit-oauth2-token-endpoint.md): Out of the box it is not a configurable option to limit token creation through the OAuth2 plugin. - [Kong Gateway is unable to create a session after successfully authenticating a user](https://developer.konghq.com/support/kong-gateway-is-unable-to-create-a-session-after-successfully-authenticating-a-user.md): Kong Manager or the Dev Portal can fail to create a session, with the browser rejecting the session cookie for an invalid domain, when the host domain is on the Mozilla Public Suffix List. Use a more narrowly scoped domain or private DNS to work around it. - [Kong Gateway: Key-Auth on Consumer isn't working with Vault secrets](https://developer.konghq.com/support/kong-gateway-key-auth-on-consumer-isn-t-working-with-vault-secrets.md): This is expected behavior at this time as there is no support yet for referenceable fields in the `key-auth` plugin. - [Kong Gateway: Kong Manager Login Not Working in OpenShift](https://developer.konghq.com/support/kong-gateway-kong-manager-login-not-working-in-openshift.md): In OpenShift, using HTTP/2 with passthrough Routes that share the same SSL certificate across the Kong Manager and Admin API routes causes connection coalescing, which crisscrosses requests between them and breaks Kong Manager login. - ["nginx configuration is invalid" error when starting Kong with a custom template built for a different Kong version](https://developer.konghq.com/support/kong-gateway-nginx-configuration-is-invalid.md): The `nginx configuration is invalid` error occurs when starting Kong with a custom Nginx template built from a `nginx_kong.lua` of a different Kong version — keep custom templates in sync with the Kong version you're running. - [`no matches for kind "HorizontalPodAutoscaler" in version "autoscaling/v2beta2"` error during a Helm upgrade after upgrading Kubernetes to 1.26](https://developer.konghq.com/support/kong-gateway-no-matches-for-kind-horizontalpodautoscaler-in-version-autoscaling-v2beta2.md): A Helm upgrade of the Kong deployment fails with `no matches for kind "HorizontalPodAutoscaler" in version "autoscaling/v2beta2"` after upgrading Kubernetes to 1.26, because that API version was removed. Fix it by editing the stored Helm release Secret or ConfigMap to reference `autoscaling/v2` instead. - [Kong Gateway: OIDC plugin is returning error "invalid iat claim" on login](https://developer.konghq.com/support/kong-gateway-oidc-plugin-is-returning-error-invalid-iat-claim-on-login.md): This error occurs because the time of the host machine and the IDP are out of sync. - [Kong Gateway: OIDC plugin - Troubleshooting High Redis Memory Usage](https://developer.konghq.com/support/kong-gateway-oidc-plugin-troubleshooting-high-redis-memory-usage.md): Explains why Redis memory usage grows unbounded when the OIDC plugin's bearer and session auth methods create redundant sessions, and how to fix it by tuning `session_rolling_timeout` and disabling sessions for bearer authentication. - [Kong Gateway: OIDC plugin with Redis session storage calls auth endpoint irregularly](https://developer.konghq.com/support/kong-gateway-oidc-plugin-with-redis-session-storage-calls-auth-endpoint-irregularly.md): Explains why the OIDC plugin's Redis-backed sessions re-authorize earlier than the Access Token TTL, caused by having both `session_idling_timeout` and `session_rolling_timeout` configured together, and how removing `session_idling_timeout` fixes it. - [Kong Gateway: OpenID plugin with Okta receiving "Cannot request 'openid' scopes using client credentials."](https://developer.konghq.com/support/kong-gateway-openid-plugin-with-okta-receiving-cannot-request-openid-scopes-using-client-credentials.md): Some IDPs, such as Okta, don't allow the `openid` scope with the `client_credentials` grant type, causing the OpenID Connect plugin to return an `invalid_scope` error. Fix it by creating a custom scope in the IDP and updating the plugin's scopes to use it instead of `openid`. - [Correlation ID header override and passthrough behavior](https://developer.konghq.com/support/kong-gateway-overridingduplication-of-correlation-id-header.md): You can pass a custom correlation ID by including a Kong-Request-Id header in your request. The Correlation ID plugin passes the provided value through unchanged instead of generating a new UUID. - [Kong Gateway: Receiving error "entity tags missing fields" error="no namespace" name=openid-connect](https://developer.konghq.com/support/kong-gateway-receiving-error-entity-tags-missing-fields-error-no-namespace-name-openid-connect.md): This error occurs typically due to not recognizing the license that has been created. - ["Invalid Semantic Version" SemVer error when installing or upgrading Kong Gateway with Helm using an invalid `image.tag` value](https://developer.konghq.com/support/kong-gateway-receiving-semver-errors-when-installing-gateway-3-4-0-0-with-helm.md): Explains the Helm SemVer validation error (`Invalid Semantic Version`) that occurs when the chart's `image.tag` value doesn't match the required version format for Enterprise or open source Kong Gateway images. - [Kong Gateway: Sharing OIDC session across plugin instances](https://developer.konghq.com/support/kong-gateway-sharing-oidc-session-across-plugin-instances.md): This can be done by using the same session secret across multiple plugin instances. - [Kong Gateway: unsafe legacy renegotiation disabled error after 3.4.0.0 upgrade](https://developer.konghq.com/support/kong-gateway-unsafe-legacy-renegotiation-disabled-error-after-3-4-0-0-upgrade.md): In Kong Gateway 3.4.0.0+ we have bumped OpenSSL to 3.1.1+. - [Kong Gateway: User roles are being intermittently removed/updated](https://developer.konghq.com/support/kong-gateway-user-roles-are-being-intermittently-removed-updated.md): This can occur when you manually assign roles, either through Manager or the Admin API, but have also defined an `authenticated_groups_claim` in your `admin_gui_auth_conf`. - [Why the Proxy Caching Advanced plugin always bypasses the cache](https://developer.konghq.com/support/kong-gateway-why-is-the-proxy-caching-advanced-plugin-always-bypassing-the-cache-and-hitting-the-api.md): The Proxy Caching Advanced plugin may always bypass the cache and hit the API if the upstream response's content type is not included in the plugin's configuration. - [Kong Ingress Controller: Deploying the KIC with no Enterprise license](https://developer.konghq.com/support/kong-ingress-controller-deploying-the-kic-with-an-expired-license.md): This error occurs when no Enterprise license (not an expired one) is present, so enterprise-only plugins are rejected. - [Kong Ingress Controller: Ingress with a particular route host name fails due to invalid value](https://developer.konghq.com/support/kong-ingress-controller-ingress-with-a-particular-route-host-name-fails-due-to-invalid-value.md): Kong Ingress Controller rejects an Ingress `host` value containing an underscore because Kubernetes enforces RFC 1123 hostname rules. - [Kong Ingress Controller is not affected by IngressNightmare](https://developer.konghq.com/support/kong-ingress-controller-is-not-affected-by-ingressnightmare.md): Kong Ingress Controller (KIC) is not impacted or affected by the vulnerability "IngressNightmare". - [Kong Konnect: Using a Service Account without an email address with OIDC for the Developer Portal](https://developer.konghq.com/support/kong-konnect-how-can-we-utilize-a-service-account-no-email-with-oidc-for-konnect-developer-portal.md): Remove the `email` scope from the OIDC identity provider configuration on the Konnect Developer Portal so Service Accounts without an email address can log in. - [Kong Konnect: Uploading a custom plugin schema to a Konnect Ingress Controller Control Plane](https://developer.konghq.com/support/kong-konnect-how-do-i-upload-a-custom-plugin-schema-to-a-konnect-ingress-controller-control-plane.md): Currently the only way to do this is via the Konnect Admin API as the KIC Control Plane GUI is read-only. - [Kong Konnect: How to publish/unpublish an API Product using the Admin API](https://developer.konghq.com/support/kong-konnect-how-to-publish-unpublish-an-api-product-using-the-admin-api.md): Publish or unpublish an API Product without specifying a version by using the Konnect Admin API's v2 API Products endpoint. - [Kong Konnect: KIC Control Plane shows not "Fully Operational" after creating Ingress objects](https://developer.konghq.com/support/kong-konnect-kic-control-plane-shows-not-fully-operational-after-creating-ingress-objects.md): KIC's "Failed pushing configuration to Konnect" validation error is a blanket message that, in this case, is caused by route/service names generated from Ingress objects exceeding Konnect's character limit. - [Kong Konnect Terraform provider "no version is selected" error when the provider is not yet initialized](https://developer.konghq.com/support/kong-konnect-provider-registry-terraform-io-kong-konnect-required-by-this-configuration-but-no-version-is-selected.md): This will occur when you have not yet initialized the Konnect provider. - [Kong Log Rotation](https://developer.konghq.com/support/kong-log-rotation.md): While there is no built in mechanism to rotate logs inside of Kong, we suggest using the Linux tool `logrotate`. - [Kong Manager login fails with SSL handshake error: "ssl3_get_record:wrong version number"](https://developer.konghq.com/support/kong-manager-login-fails-with-ssl-handshake-error-ssl3-get-record-wrong-version-number.md): The most common cause of this SSL error is sending HTTPS requests to an endpoint that only listens on HTTP. - [Kong Manager or other Service is in a redirect loop after OpenID Connect integration](https://developer.konghq.com/support/kong-manager-or-other-service-is-in-a-redirect-loop-after-openid-connect-integration.md): There are a number of possible causes for this behavior where a redirect loop is seen when using the OpenID-Connect (OIDC) plugin for authentication. - [Kong Mesh: Observability/tracing troubleshooting steps](https://developer.konghq.com/support/kong-mesh-observability-tracing-troubleshooting-steps.md): General troubleshooting steps for diagnosing why Kong Mesh Observability/tracing isn't collecting the expected data, using the `kuma-demo` app and Envoy config dumps. - [`x-kong-proxy-latency` header exceeds the timeout limit specified on the service](https://developer.konghq.com/support/kong-proxy-latency-exceeds-timeout-limit-specified-on-service.md): Kong's `x-kong-proxy-latency` header keeps climbing beyond the configured timeout because Kong retries a slow upstream according to the service's `retries` setting, adding each retry's latency to the total. - [Kong worker processes exited on signal 9](https://developer.konghq.com/support/kong-worker-processes-exited-on-signal-9.md): This issue can be caused when Kong config parameter `nginx_worker_processes` is set to `auto`, which means it depends on the amount of cores of your nodes. - [kong worker processes getting killed due to memory issues (after moving to a new host)](https://developer.konghq.com/support/kong-worker-processes-getting-killed-due-to-memory-issues.md): A common reason why the OOMKiller may kick in on a kong node is due to the configuration of the number of worker processes in kong. - [LDAP authentication for Kong Manager failed with "User not found" error message](https://developer.konghq.com/support/ldap-authentication-for-kong-manager-failed-with-user-not-found-error-message.md): LDAP login to Kong Manager fails with a "user not found" error when the LDAP user does not exist or is not under the configured `base_dn` — a different, later-stage error than "Admin not found." - [LDAP Authentication query fails when referrals are used. Errors: "failed ldap search" & "received incorrect Op in packet"](https://developer.konghq.com/support/ldap-authentication-query-fails-when-referrals-are-used-errors-failed-ldap-search-received-incorrect-op-in-packet.md): As of now, the Kong LDAP Authentication plugin does not support LDAP referrals. - [Resolving the LLM route chat type error](https://developer.konghq.com/support/llm-route-chat-type-error.md): How to fix the LLM route chat type error by sending the correct Content-Type header to Kong Gateway. - [Meet CORS error when using openid-connect to login Kong Manager](https://developer.konghq.com/support/meet-cors-error-when-use-openid-connect-to-login-kong-manager.md): A CORS error appears when logging in to Kong Manager through OpenID Connect because `login_action: redirect` in `KONG_ADMIN_GUI_AUTH_CONF` (or `admin_gui_auth_conf`) makes Kong Manager redirect to itself via the Admin API. - [Missing Access-Control-Allow-Origin header with CORS plugin](https://developer.konghq.com/support/no-access-control-allow-origin-header-is-present-on-the-requested-resource.md): The CORS plugin omits the Access-Control-Allow-Origin header when config.origins contains an invalid character or when the request origin does not match a configured origin. - ["no Route found with those values while prereading client data" error when a TCP connection doesn't match any route](https://developer.konghq.com/support/no-route-found-with-those-values-while-prereading-client-data.md): This error is the TCP equivalent of "no Route matched with those values," indicating that no suitable route was found for the connection. - [OIDC - Wild card support for login redirects with Azure as an IDP](https://developer.konghq.com/support/oidc-wild-card-support-for-azure-idp.md): A static `redirect_uri` combined with `login_action=redirect` lets the OIDC plugin redirect back to the originally requested URL after authentication, working around Azure AD's lack of wildcard login redirect support. - [On a new Kong node, Kong fails to start with the error " plugin is in use but not enabled"](https://developer.konghq.com/support/on-a-new-kong-node-kong-fails-to-start-with-an.md): This error means a plugin is configured on a route, service, or consumer (and recorded in the Kong database) but is not enabled in this node's `plugins` configuration option. - [Open ID Connect plugin fails with 'invalid issuer' error when authenticating with Azure AD](https://developer.konghq.com/support/open-id-connect-plugin-fails-with-invalid-issuer-error-when-authenticating-with-azure-ad.md): When configuring the Open ID Connect plugin with Azure AD, the user authenticates successfully in the external IDP but it receives an Unauthorized error on Kong's side. - [openid-connect plugin authentication fails, and logs have a timeout error when loading discovery information](https://developer.konghq.com/support/openid-connect-plugin-authentication-fails-and-logs-have-an.md): The timeout log entry when accessing the IdP discovery endpoint indicates that the Kong node cannot reach the discovery endpoint. - [OpenID Connect plugin continuing to process revoked tokens](https://developer.konghq.com/support/openid-connect-plugin-continuing-to-process-revoked-tokens.md): It is possible to force Kong to recognize the access token is revoked. - [OpenTelemetry plugin in Kong is naming all transactions statically as "kong"](https://developer.konghq.com/support/opentelemetry-plugin-in-kong-is-naming-all-transactions-statically-as-kong.md): A pre-function plugin can set the OpenTelemetry trace name to include the request method and path, working around Kong naming all transactions statically as "kong". - [pg_max_concurrent_queries is per worker process, not per node](https://developer.konghq.com/support/pg_max_concurrent_queries-per-worker-process.md): How to limit the total number of PostgreSQL database connections when running Kong Gateway on multiple nodes in Kubernetes. - [`plugin is enabled but not installed` error when Kong can't locate the plugin's source code](https://developer.konghq.com/support/plugin-is-enabled-but-not-installed.md): How to resolve the `plugin is enabled but not installed` error, which occurs when Kong can't find a plugin's source code because of the wrong image, a missing plugins directory, or an external volume mount. - [Postgres logs "could not receive data from client: Connection reset by peer" when TLS is enabled](https://developer.konghq.com/support/postgres-logs-could-not-receive-data-from-client-connection-reset-by-peer-when-tls-is-enabled.md): Why Postgres logs a `could not receive data from client: Connection reset by peer` message after TLS is enabled, and why it's expected behavior. - [Rate Limiting Advanced plugin allowing for limits much larger than specified using ElastiCache cluster in AWS](https://developer.konghq.com/support/rate-limiting-advanced-plugin-allowing-for-limits-much-larger-than-specified-using-elasticache-cluster-in-aws.md): Why the `Rate Limiting Advanced` plugin allows more requests than configured when using an AWS ElastiCache cluster, and how to fix it by specifying the cluster address correctly. - [Rate Limiting Advanced plugin showing WARN in logs when `sync_rate` set between 0 and 1](https://developer.konghq.com/support/rate-limiting-advanced-plugin-showing-warn-in-logs-when-sync-rate-set-between-0-and-1.md): A `sync_rate` between 0 and 1 for the Rate Limiting Advanced plugin logs a WARN because values below 1 second are permitted but not recommended. - [Rate Limiting Advanced plugin with arrays in `config.limit` and `config.window_size`](https://developer.konghq.com/support/rate-limiting-advanced-plugin-with-arrays-in-config-limit-and-config-window-size.md): When using an Array in the `Config.Limit` and `Config.Window_size` it will cycle through the first limit condition inside the first window size. - [Recommendations when running Kong in DBless mode](https://developer.konghq.com/support/recommedations-when-running-kong-in-dbless-mode.md): Best practices for sizing `nginx_worker_processes`, compute resources, and `mem_cache_size` when running Kong Gateway in DB-less mode. - [Reduce the number of Nginx timers used by the Rate Limiting Advanced plugin](https://developer.konghq.com/support/reduce-the-number-of-nginx-timers-used-by-the-rate-limiting-advanced-plugin.md): How the `namespace` parameter of the Rate Limiting Advanced plugin can create excessive Nginx timers, and how to reduce timer usage by sharing a single namespace value across plugin instances. - [Requests with invalid Authorization header return 302 response instead of 401 when using the OpenID Connect plugin](https://developer.konghq.com/support/requests-with-invalid-authorization-header-return-302-response-instead-of-401.md): The OpenID Connect plugin's default `config.auth_methods` includes all authentication methods, so a request with an invalid Authorization header falls through to the authorization code flow and gets a 302 redirect instead of a 401. - [Response Transformer plugin is unable to remove headers containing an underscore in the name](https://developer.konghq.com/support/response-transformer-plugin-is-unable-to-remove-headers-containing-an-underscore-in-the-name.md): How to work around the Response Transformer plugin's inability to remove response headers that contain an underscore in the name, using the `nginx_http_more_clear_headers` directive. - [Security Vulnerability Scan for Docker Images with Docker Scout](https://developer.konghq.com/support/security-vulnerability-scan-for-docker-images-with-docker-scout.md): Use Docker Scout to scan a Kong Gateway Docker image and identify which CVEs its packages may be vulnerable to. - [Setting up Kong with SMTP server to use for admin invite or forgot password (using Gmail SMTP server)](https://developer.konghq.com/support/setting-up-kong-with-smtp-using-gmail-smtp-server.md): Configure Kong to send admin invite and forgot-password emails using Gmail's SMTP server and an app password. - [Setup status endpoint that doesn't require authentication when RBAC is enabled](https://developer.konghq.com/support/setup-status-endpoint-that-doesn-t-require-authentication-when-rbac-is-enabled.md): Kong Gateway's built-in `status_listen` endpoint (port 8100 by default) provides unauthenticated health checks even when RBAC is enabled; expose the Admin API's `/status` endpoint through the proxy only if you specifically need it there. - [single `deck sync` command does not create objects in different workspaces](https://developer.konghq.com/support/single-deck-sync-command-does-not-create-objects-in-different-workspaces.md): Running `deck sync` with YAML files from multiple workspaces in one invocation can throw an "entity already exists" error or silently put everything in a single workspace; run `deck sync` once per workspace instead. - [The AWS Lambda plugin is not adding the `X-Forwarded-*` headers to requests](https://developer.konghq.com/support/the-aws-lambda-plugin-is-not-adding-the-x-forwarded-headers-to-requests.md): These headers are added by the nginx proxy module when traffic traverses the Gateway. - [The `clustering/data-planes` endpoint is limited to showing only 100 entries](https://developer.konghq.com/support/the-clustering-data-planes-endpoint-is-limited-to-showing-only-100-entries.md): As with other endpoints, the data-planes endpoint supports query parameters to increase or limit the size. - [The `openid-connect` plugin does not set the `audience` form parameter with `client_credentials` auth method](https://developer.konghq.com/support/the-openid-connect-plugin-does-not-set-the-audience-form-parameter-when-making-request.md): Setting the `config.audience` parameter in the `openid-connect` configuration options does NOT cause the plugin to add the required form parameter. - [The Rate Limiting Advanced plugin throws an error attempting to perform arithmetic on a nil value](https://developer.konghq.com/support/the-rate-limiting-advanced-plugin-throws-an-error-attempting-to-perform-arithmetic-on-a-nil-value.md): A `nil` value arithmetic crash in the Rate Limiting Advanced plugin under heavy load, caused by evicted counters in an undersized `lua_shared_dict`; fixed as of Kong Gateway 3.14.0.0, but proper `kong_rate_limiting_counters` sizing is still good practice. - [The size of shared memory zone "kong_rate_limiting_counters" conflicts with already declared size errors on startup](https://developer.konghq.com/support/the-size-of-shared-memory-zone-kong-rate-limiting-counters-conflicts-with-already-declared-size.md): Dictionaries whose values are set in `/usr/local/share/lua/5.1/kong/templates/nginx_kong.lua` are not configurable via the configuration file. - [Unable to access Kong GUIs with latest browsers when using self-signed certificates](https://developer.konghq.com/support/unable-to-access-kong-guis-with-latest-browser-when-using-self-signed-certificates.md): Browsers require accepting a self-signed certificate warning separately for Kong Manager, the Admin API, and the Proxy before the UI will load. - [Unable to load value from vault (`env`)](https://developer.konghq.com/support/unable-to-load-value-from-vault-env.md): Kong's `env` vault backend can fail with "could not get value from external vault (no value found)" if the environment variable name isn't uppercase, is set under a different user account, or was added without reloading Kong. - [Unable to login to Kong Manager despite a valid id/password](https://developer.konghq.com/support/unable-to-login-to-kong-manager-despite-a-valid-id-password.md): This issue occurs when the URL that is used to access Kong does not match the URL defined in the Kong configuration (`kong.conf`). - [Unable to mark Upstream targets as healthy or unhealthy via Kong manager](https://developer.konghq.com/support/unable-to-mark-upstream-targets-as-healthy-or-unhealthy-via-kong-manager.md): Kong Manager returns a 400 error when marking Upstream targets healthy or unhealthy because active health checks are not enabled on the upstream. - [Using an existing PostgreSQL database server with a fresh Kong install](https://developer.konghq.com/support/using-an-existing-postgres-database-with-kong.md): Steps to create a Kong role and database in an existing PostgreSQL server, including how to work around a permission error on managed services like RDS. - [Using OIDC with a custom bearer token header](https://developer.konghq.com/support/using-oidc-with-a-custom-bearer-token-header.md): Use the serverless `pre-function` plugin to copy a bearer token from a custom header into the `Authorization` header so the OIDC plugin can find it. - [Using the decK configuration file](https://developer.konghq.com/support/using-the-deck-configuration-file.md): decK can store global parameters like the Kong host and Admin token in a config file (`$HOME/.deck.yaml` by default) to make it easy to switch between environments. - [We seem to have a memory leak on our kong nodes after adding a large number of regex routes](https://developer.konghq.com/support/we-seem-to-have-a-memory-leak-on-our-kong-nodes-after-adding-a-large-number-of-regex-routes.md): Configuring more regex routes than the default `nginx_http_lua_regex_cache_max_entries` (8192) causes Lua regex cache thrashing and rising memory usage on Kong nodes. - [We would like to capture information about requests that do not match a route in Kong](https://developer.konghq.com/support/we-would-like-to-capture-information-about-requests-that-return-a-404.md): A global Kong log plugin on a non-default workspace does not log 404 responses for unmatched routes; add a global log plugin to the default workspace to capture them. - [Minimum `kong.conf` parameters needed to use a custom TLS certificate with Kong Manager](https://developer.konghq.com/support/what-are-the-minimum-configuration-needed-to-enable-https-on-kong-manager.md): Kong Manager serves HTTPS by default with a self-signed certificate — these `kong.conf` parameters are only needed to replace it with your own custom certificate. - ["SSL_do_handshake() failed (SSL: error:XXXXXXSSL routines::bad key share)" errors in Kong logs](https://developer.konghq.com/support/what-are-the-ssl-do-handshake-failed-ssl-error-xxxxxxssl-routines-bad-key-share-errors-in-my-kong-logs.md): The `SSL_do_handshake()` bad key share errors are typically caused by outdated clients or by network probes, and are usually benign background noise when Kong is exposed to the internet. - [Response buffering in Kong and how it's controlled](https://developer.konghq.com/support/what-is-response-buffering-in-kong-and-how-is-it-controlled.md): Explains why Kong Gateway sometimes buffers upstream responses to a temporary file and how to control this behavior with `proxy_max_temp_file_size`. - [Expected behavior for the Rate Limiting plugin with a path identifier](https://developer.konghq.com/support/what-is-the-expected-behaviour-for-the-rate-limiting-plugin-with-path-identifier.md): Explains how the Rate Limiting plugin's `path` identifier keeps a separate counter for the configured path and a shared counter for all other paths, with an example walkthrough. - [Purpose of the OIDC `display_errors` setting and customizing plugin error messages](https://developer.konghq.com/support/what-is-the-purpose-of-the-oidc-display-errors-setting-and-how-can-the-plugin-error-messages-be-customised.md): The `config.display_errors` toggle enables extra debugging detail in OpenID Connect plugin errors; use the Exit Transformer plugin to customize the error messages returned to clients. - [Log messages shown for expiring and expired Kong Gateway Enterprise licenses](https://developer.konghq.com/support/what-log-messages-are-shown-for-expiring-expired-licenses.md): Kong logs warning, error, and two levels of critical messages as an Enterprise license approaches and passes its expiration date, so you can configure alerts in an external log tool. - [How do I adjust resources to increase maximum throughput for Kong Gateway in Kubernetes?](https://developer.konghq.com/support/what-resources-should-be-adjusted-for-kong-deployed-in-a-kubernetes-environment-to-increase-maximum-throughput.md): When scaling Kong Gateway in Kubernetes to increase maximum throughput, ensure adequate CPU and memory resources and use performance benchmarking to determine the precise requirements. - [Understanding and preventing route collisions in Kong Gateway](https://developer.konghq.com/support/what-steps-should-be-taken-to-understand-and-prevent-route-collisions-in-kong-gateway.md): Route collisions occur when multiple routes match the same request criteria; use `KONG_ROUTE_VALIDATION_STRATEGY`, decK lint rulesets, and Kong Manager permission restrictions to detect and prevent them. - [When adding a header using the request-tranformer the header is not sent to the upstream server](https://developer.konghq.com/support/when-adding-a-header-using-the-request-tranformer-the-header-is-not-sent-to-the-upstream-server.md): The `request-transformer` plugin evaluates `config.remove.headers`, `config.replace.headers`, and `config.add.headers` in that order, so a header added via `config.add.headers` is skipped if the client already sent it. - [When running in hybrid mode with shared keys, the Data Plane does not connect to the Control Plane](https://developer.konghq.com/support/when-running-in-hybrid-mode-with-shared-keys-the-data-plane-does-not-connect-to-the-control-plane.md): In hybrid shared mode, the certificates must have a common name of `kong_clustering`. - [Kong Manager login error: `config.client_secret` length must be at least 1](https://developer.konghq.com/support/when-trying-to-log-into-kong-manager-getting-error-config-secret-length-must-be-at-least-1.md): Logging into Kong Manager fails with a `config.client_secret` schema violation when the OIDC `client_secret` value is empty. - [When using Route By Header, a CORS pre-flight request fails with a 404 error](https://developer.konghq.com/support/when-using-route-by-header-a-cors-pre-flight-request-fails-with-a-404-error.md): A Route configured to match on a custom header using the `headers` field returns a 404 error for CORS pre-flight OPTIONS requests because the pre-flight request doesn't include the custom header. - [When using the `file-log` plugin, the output file is not created](https://developer.konghq.com/support/when-using-the-file-log-plugin-the-output-file-is-not-created.md): Explains why `file-log` plugin output isn't created when Kong runs under systemd, where `PrivateTmp` redirects `/tmp` writes to a private systemd directory instead of the configured path. - [When using the `openid-connect` plugin with client credential auth method the tokens are not cached](https://developer.konghq.com/support/when-using-the-openid-connect-plugin-with-client-credential-auth-method-the-tokens-are-not-cached.md): Explains why the `openid-connect` plugin doesn't cache tokens when both `client_credentials` and `password` are enabled in `auth_methods` and credentials are sent via a Basic auth header. - [Single-quoted values in decK dump files](https://developer.konghq.com/support/why-are-some-plugin-configuration-values-in-kong-s-deck-dump-file-enclosed-in-single-quotes.md): decK dump files use YAML, which automatically quotes strings containing special characters or values that would otherwise be misinterpreted by the YAML parser. - [Why Kong requires both a certificate and its private key when loading certificates](https://developer.konghq.com/support/why-do-i-need-to-provide-a-certificate-and-a-key-when-loading-certificates-into-kong.md): Explains why Kong requires both a certificate and its matching private key when loading certificates, since proving control of the private key is what authenticates the certificate. - [HTTP 499 response codes from Kong when a client closes the connection early](https://developer.konghq.com/support/why-does-kong-return-a-499-response-codes.md): Kong returns HTTP 499 when a client closes the connection before Kong finishes sending the response back, which indicates a client-side issue rather than a Kong or upstream problem. - [File Log plugin output mixed with Kong Gateway log entries](https://developer.konghq.com/support/why-does-the-output-of-the-file-log-plugin-get-mixed-with-kong-log-entries.md): When the File Log plugin writes to /dev/stdout in a containerized environment, log entries can interleave because the Linux kernel can't guarantee atomicity for writes larger than the PIPE_BUF limit (4096 bytes). - [Wrong metrics from Prometheus plugin](https://developer.konghq.com/support/wrong-metrics-from-prometheus-plugin.md): Metrics reported by the Prometheus plugin can be missing or incomplete because `status_code_metrics`/`latency_metrics` aren't enabled, or because the `prometheus_metrics` shared dictionary has reached its default size limit and is dropping older metrics. - [Kong Gateway Web Application Firewall](https://developer.konghq.com/waf.md): Learn how Kong Gateway provides web application firewall style protections through plugins such as Injection Protection, Request Validator, JSON Threat Protection, XML Threat Protection, Bot Detection, IP Restriction, and rate limiting. ## Kong Identity - [Kong Identity](https://developer.konghq.com/identity.md): Unified authentication platform within Kong Konnect. - [Kong Identity authorization servers, claims, scopes, and clients](https://developer.konghq.com/identity/auth-servers.md): Kong Identity enables you to use Konnect to generate, authenticate and authorize API access. Kong Identity implements the OAuth2.0 standard with OpenID Connect for authentication and authorization. - [Principals and directories](https://developer.konghq.com/identity/principals.md): Learn how Kong Identity principals and directories represent authenticating entities and centralize identity, credentials, and metadata across Kong Gateway, Event Gateway, and Dev Portal. ## Kong Ingress Controller - [Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller.md): Configure Kong Gateway using Kubernetes CRDs with Kong Ingress Controller - [Admission Webhook](https://developer.konghq.com/kubernetes-ingress-controller/admission-webhook.md): What is the Kong Ingress Controller admission webhook? How do I enable it? What does it validate? - [Architecture](https://developer.konghq.com/kubernetes-ingress-controller/architecture.md): How does Kong Ingress Controller work? Which Kubernetes resources does it interact with? - [Understanding IngressClass / GatewayClass](https://developer.konghq.com/kubernetes-ingress-controller/class-annotations.md): Which resources require an IngressClass / GatewayClass to be reconciled by Kong Ingress Controller? - [Custom Resources](https://developer.konghq.com/kubernetes-ingress-controller/custom-resources.md): Which custom resources does Kong Ingress Controller provide? How are they used to configure Kong Gateway? - [Customize Images](https://developer.konghq.com/kubernetes-ingress-controller/customize-image.md): Customize the image name used for Kong Ingress Controller and Kong Gateway - [Database backed](https://developer.konghq.com/kubernetes-ingress-controller/deployment-topologies/db-backed.md): Use Kong Ingress Controller to configure a Kong Gateway Control Plane that is attached to a PostgreSQL database. - [Gateway Discovery](https://developer.konghq.com/kubernetes-ingress-controller/deployment-topologies/gateway-discovery.md): Use one Kong Ingress Controller instance to configure multiple Kong Gateway instances. Gateway Discovery is Kong's recommended deployment topology for the Kong Ingress Controller. - [Sidecar (Traditional)](https://developer.konghq.com/kubernetes-ingress-controller/deployment-topologies/sidecar.md): Deploy Kong Ingress Controller and Kong Gateway as containers in the same Pod. This topology is deprecated. - [Fallback configuration](https://developer.konghq.com/kubernetes-ingress-controller/fallback-configuration.md): Prevent Kong Ingress Controller lock-ups when bad configuration is accidentally introduced to your k8s cluster - [Combining Services from different HTTPRoutes](https://developer.konghq.com/kubernetes-ingress-controller/faq/combining-httproutes.md): Reduce the number of Gateway Services generated by Kong Ingress Controller when using HTTPRoutes - [Configuring Custom Entities](https://developer.konghq.com/kubernetes-ingress-controller/faq/custom-entities.md): How do I configure Custom Entities such as degraphql_routes using KIC? - [Use a custom nginx.conf file](https://developer.konghq.com/kubernetes-ingress-controller/faq/custom-nginx-conf.md): How do I use a custom nginx.conf file with ConfigMap or Secret? - [Migrating from Ingress to Gateway API](https://developer.konghq.com/kubernetes-ingress-controller/faq/migrate-ingress-to-gateway.md): Which custom Ingress annotations are replaced with Gateway API features? - [Upgrading Kong Gateway using Helm](https://developer.konghq.com/kubernetes-ingress-controller/faq/upgrading-gateway.md): What do I need to know when upgrading Kong Gateway on Kubernetes? DB-backed mode vs DB-less - [Upgrading Kong Ingress Controller using Helm](https://developer.konghq.com/kubernetes-ingress-controller/faq/upgrading-ingress-controller.md): Upgrade Kong Ingress Controller safely, taking in to account Gateway API version changes - [Gateway API](https://developer.konghq.com/kubernetes-ingress-controller/gateway-api.md): Learn about support for Gateway API resources such as Gateway and GatewayClass in Kong Ingress Controller - [Ingress](https://developer.konghq.com/kubernetes-ingress-controller/ingress.md): Understand how Ingress and IngressClass work with Kong Gateway. - [KIC high availability](https://developer.konghq.com/kubernetes-ingress-controller/kic-high-availability.md): How to run multiple Kong Ingress Controller instances with leader election - [Last Known Good Config](https://developer.konghq.com/kubernetes-ingress-controller/last-known-good-config.md): Prevent Kong Ingress Controller lockups by falling back to the last known good configuration when invalid configuration is applied - [Apply an Enterprise license with Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller/license.md): Learn how to apply a Kong Gateway enterprise license using the `KongLicense` CRD or Kubernetes secrets - [Add credential type labels](https://developer.konghq.com/kubernetes-ingress-controller/migrate/credential-kongcredtype-label.md): Add the konghq.com/credential label to your Secrets to improve performance and security. - [Migrating from Ingress to Gateway API](https://developer.konghq.com/kubernetes-ingress-controller/migrate/ingress-to-gateway.md): How to migrate from deprecated Ingress API resources (including TCPIngress and UDPIngress) to the Gateway API - [Migrating from KongIngress to annotations and KongUpstreamPolicy](https://developer.konghq.com/kubernetes-ingress-controller/migrate/kongingress.md): Learn how to migrate from the deprecated KongIngress resource to annotations and KongUpstreamPolicy. - [Kubernetes Events](https://developer.konghq.com/kubernetes-ingress-controller/observability/events.md): Kong Ingress Controller emits Kubernetes events to help you observe what's happening in your cluster. - [Prometheus metrics reference](https://developer.konghq.com/kubernetes-ingress-controller/observability/prometheus.md): Understand which metrics Kong Ingress Controller exposes in Prometheus format - [Preserve client IP](https://developer.konghq.com/kubernetes-ingress-controller/preserve-client-ip.md): Learn how to pass the client IP through Gateway to the upstream service - [Annotation reference](https://developer.konghq.com/kubernetes-ingress-controller/reference/annotations.md): Learn about the annotations Kong Ingress Controller uses and the Kubernetes resources you can annotate. - [Kong Ingress Controller configuration options](https://developer.konghq.com/kubernetes-ingress-controller/reference/configuration-options.md): Learn about the various settings and configurations of the controller can be tweaked using CLI flags. - [Custom Resource (CRD) API Reference](https://developer.konghq.com/kubernetes-ingress-controller/reference/custom-resources.md): See the generated CRD structure containing all possible resource fields and descriptions for each property. - [Feature gates](https://developer.konghq.com/kubernetes-ingress-controller/reference/feature-gates.md): Learn how to customize Kong Ingress Controller's behavior using feature flags - [Rewriting hosts](https://developer.konghq.com/kubernetes-ingress-controller/reference/host-manipulation.md): Customize the Host header that is sent to your upstream service. - [Rewriting paths](https://developer.konghq.com/kubernetes-ingress-controller/reference/path-manipulation.md): Rewrite the request path before sending it to your upstream service. - [Permissions required to install Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller/reference/required-permissions.md): Learn about the permissions required to install and run Kong Ingress Controller. - [Using Kubernetes Secrets in plugins](https://developer.konghq.com/kubernetes-ingress-controller/reference/secrets-in-plugins.md): Populate your KongPlugin configuration using Kubernetes Secrets - [Using Custom Classes to split internal and external traffic](https://developer.konghq.com/kubernetes-ingress-controller/split-traffic.md): Split traffic across multiple Kong Gateway instances in a single Kubernetes cluster - [Sticky sessions in Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller/sticky-sessions-reference.md): Sticky sessions ensure that repeat client requests are routed to the same backend pod, which is essential for maintaining user session state. - [Kong Ingress Controller version support policy](https://developer.konghq.com/kubernetes-ingress-controller/support.md): The Kong Ingress Controller version support policy outlines the Kong Ingress Controller versioning scheme and version lifecycle, from release to sunset support. - [Debugging Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller/troubleshooting/debugging.md): How do I enable debug logs and capture network traffic to debug? - [Failure modes](https://developer.konghq.com/kubernetes-ingress-controller/troubleshooting/failure-modes.md): Learn about the different ways Kong Ingress Controller can fail. - [Debugging Kong Gateway configuration](https://developer.konghq.com/kubernetes-ingress-controller/troubleshooting/kong-gateway-configuration.md): Learn how to debug a broken Kong Gateway configuration generated by Kong Ingress Controller. - [Debugging KIC in Konnect](https://developer.konghq.com/kubernetes-ingress-controller/troubleshooting/konnect.md): Gain insights into the KIC in Konnect synchronization process using traces. - [Debugging Kubernetes API Server connectivity](https://developer.konghq.com/kubernetes-ingress-controller/troubleshooting/kubernetes-api-server.md): Learn how to customize Kong Ingress Controller's connection to the Kubernetes API Server. - [Version compatibility](https://developer.konghq.com/kubernetes-ingress-controller/version-compatibility.md): Learn about the versions of Kong Ingress Controller compatible with specific versions of Kong Gateway, Kubernetes, Gateway API and Istio. - [Using Workspaces](https://developer.konghq.com/kubernetes-ingress-controller/workspaces.md): Learn how to use KIC to sync resources to a specific Kong Gateway Workspace. Deploy multiple namespaces and use the --watch-namespace flag with a Workspace. - [Azure Load Balancer health probe fails for Kong proxy service](https://developer.konghq.com/support/azure-load-balancer-health-probe-fails-for-kong-proxy-service.md): When running Kong on Kubernetes v1.24 or higher with Azure Load Balancer, the health probe created by the Load Balancer fails and causes the Azure Kubernetes service to restart the Kong proxy service repeatedly, typically when HTTP is enabled for the proxy service. - [Error: This instance contains workspaced entities that need a custom migration in Helm upgrade](https://developer.konghq.com/support/error-this-instance-contains-workspaced-entities-that-need-a-custom-migration-in-helm-upgrade.md): If this error appears during a Helm upgrade, it usually means you are using an older chart version; update the Helm repo and rerun the upgrade. - [Taking a packet capture in a Kong pod in a Kubernetes environment](https://developer.konghq.com/support/how-can-i-take-a-packet-capture-in-a-kong-pod-in-a-kubernetes-environment.md): Add a sidecar container running a `tcpdump` image to the Kong pod to capture packet traffic in a Kubernetes environment where the standard Kong image doesn't include `tcpdump` or root access. - [How to configure upstream healthchecks with the Ingress Controller](https://developer.konghq.com/support/how-to-configure-upstream-healthchecks-with-the-ingress-controller.md): Explains how to configure upstream circuit breakers and active healthchecks through the Kong Ingress Controller, covering both the legacy `KongIngress` resource (KIC 2.5/2.12 LTS) and the annotation-based approach (KIC 3.1+). - [How to enable debug logs for the Kubernetes Ingress Controller](https://developer.konghq.com/support/how-to-enable-debug-logs-for-the-kubernetes-ingress-controller.md): Set the Kubernetes Ingress Controller's log level to debug using the `log-level` CLI flag, the `CONTROLLER_LOG_LEVEL` environment variable, or the `log_level` key under `ingressController.env` in the Helm chart. - [How to log the pod name of the Kong Gateway node that processed a request](https://developer.konghq.com/support/how-to-log-the-pod-name-of-the-kong-node-that-processed-a-request-using-a-log-plugin.md): Add the data plane pod name to Kong Gateway logging plugin output by exposing the container HOSTNAME variable through the config.custom_fields_by_lua property. - [How to mount a PersistentVolume using the Kong Helm Chart](https://developer.konghq.com/support/how-to-mount-a-persistentvolume-using-the-kong-helm-chart.md): To mount a `PersistentVolume` using the Kong Helm chart, declare the volume under `deployment.userDefinedVolumes` and `deployment.userDefinedVolumeMounts` in `values.yaml`. - [How to prevent data planes from accepting traffic before they have downloaded the configuration from the control plane](https://developer.konghq.com/support/how-to-prevent-data-planes-from-accepting-traffic-before-they-have-downloaded-the-configuration-from-the-control-plane.md): An easy way to address this issue is to change the default readiness probe to use a health check route. - [How to send metrics and logs to Datadog in a Kubernetes environment](https://developer.konghq.com/support/how-to-send-metrics-and-logs-to-datadog-in-a-kubernetes-environment.md): Steps to send Kong metrics and logs to Datadog in a Kubernetes environment, using the Datadog Agent, the `prometheus` plugin, and Autodiscovery pod annotations. - [How to temporarily disable KIC Admission Controller](https://developer.konghq.com/support/how-to-temporally-disable-kic-admission-controller.md): How to temporarily disable the KIC Admission Controller for testing and troubleshooting, and re-enable it afterward. - [How to update Kong configuration that is hard coded in `/usr/local/share/lua/5.1/kong/templates/nginx_kong.lua` when using Helm charts](https://developer.konghq.com/support/how-to-update-kong-configuration-that-is-hard-coded-in-usr-local-share-lua-5-1-kong-templates-nginx-kong-lua.md): Use the Helm chart's `userDefinedVolumes` and `userDefinedVolumeMounts` to mount a custom `nginx_kong.lua` template, overriding hard-coded Nginx configuration options that Kong's default template doesn't expose. - [Kong Ingress Controller FAQs](https://developer.konghq.com/support/kic-faqs.md): Answers to common questions about Kong Ingress Controller, including gathering metrics and creating additional Kubernetes resources with the Helm chart. - ["dataplane-synchronizer Could not update kong admin - creating consumer failed due existing 'acls' entity references this 'consumers' entity" error when deploying the same consumer across multiple workspaces with Kong Ingress Controller](https://developer.konghq.com/support/kong-ingress-controller-dataplane-synchronizer-could-not-update-kong-admin-creating-consumer-failed-due-existing-acls-entity-references-this-consumers-entity.md): Explains why deploying the same consumer with ACL groups across multiple Kong Ingress Controller workspaces fails with a `creating consumer failed due existing 'acls' entity references this 'consumers' entity` error, caused by the `FillIDs` feature gate, and how to disable it. - [Kong Ingress Controller reports "failed to connect to reporting server"](https://developer.konghq.com/support/kong-ingress-controller-reports-failed-to-connect-to-reporting-server.md): Kong Ingress Controller, by default, sends anonymous usage data to help improve Kong. - [Logging to JSON format for Kubernetes](https://developer.konghq.com/support/logging-to-json-format-for-kubernetes.md): The Kong Ingress Controller supports a `--log-format` flag to switch its logs from plain text to JSON, which can be set via `ingressController.args` in the Helm chart. - [Security Hardening in Kubernetes Environments](https://developer.konghq.com/support/security-hardening-in-kubernetes-environments.md): As a guide on pod security, we recommend the official Kubernetes guide as a reference. - [`cluster` strategy not supported in the rate limiting advanced plugin for k4k8s DB-less or Kong in hybrid mode](https://developer.konghq.com/support/why-cluster-options-is-not-working-in-rate-limiting-advanced-plugin-for-k4k8s-dbless-or-kong-in-hybrid-mode.md): The reason you're seeing the error logs is because `cluster` strategy is not supported in rate limiting advanced plugin for k4k8s DB-less or Kong deployed in hybrid mode. - ["failed to fetch KongPlugin: no KongPlugin or KongClusterPlugin was found" errors in the KIC logs](https://developer.konghq.com/support/why-do-we-get-failed-to-fetch-kongplugin-no-kongplugin-or-kongclusterplugin-was-found-errors-in-the-kic-logs.md): The error suggests that you have created an Ingress rule or `KongConsumer`, and added a `konghq.com/plugins` annotation using a plugin name which does not already exist. ## Kong Mesh - [Kong Mesh](https://developer.konghq.com/mesh.md): Learn how Kong Mesh works and how to configure it. - [Kong Mesh audit logs](https://developer.konghq.com/mesh/access-audit.md): Track all user and system actions in Kong Mesh using the AccessAudit resource and configurable backends - [ACM Private CA Policy](https://developer.konghq.com/mesh/acm-private-ca-policy.md): Configure Kong Mesh to use Amazon Certificate Manager as a Certificate Authority for mTLS, including setup steps and authentication options. - [Kubernetes annotations and labels for Kong Mesh](https://developer.konghq.com/mesh/annotations.md): Reference for all Kubernetes annotations and labels available in Kong Mesh, including sidecar injection, mesh association, transparent proxy settings, and metrics configuration. - [Kong Mesh architecture](https://developer.konghq.com/mesh/architecture.md): Understand the architecture of a Kong Mesh service mesh, including control plane and data plane components, Kubernetes and Universal modes, and how services integrate into the mesh. - [Authentication with the Kong Mesh API server](https://developer.konghq.com/mesh/authentication-with-the-api-server.md): Authenticate users and automation tools to the control plane API server using user tokens, including token generation, rotation, and revocation. - [Built-in gateways in Kong Mesh](https://developer.konghq.com/mesh/built-in-gateway.md): Learn about built-in gateways with Kong Mesh using MeshGateway, MeshGatewayInstance, and Dataplane resources in both Kubernetes and Universal environments. - [Certificate Authority rotation](https://developer.konghq.com/mesh/ca-rotation.md): Rotate the mTLS backend in Kong Mesh to transition between Certificate Authorities securely and with zero downtime. - [Kubernetes cert-manager CA policy](https://developer.konghq.com/mesh/cert-manager.md): Use Kubernetes cert-manager as an mTLS backend for issuing Data Plane certificates in Kong Mesh - [Kong Mesh changelog](https://developer.konghq.com/mesh/changelog.md): Changelog for supported Kong Mesh versions. - [Kong Mesh CLI tools](https://developer.konghq.com/mesh/cli.md): Reference for the CLI tools included in Kong Mesh, including usage examples and commands for kumactl, kuma-cp, and kuma-dp. - [Configure the Kong Mesh CNI](https://developer.konghq.com/mesh/cni.md): Install and configure Kong Mesh CNI to enable transparent proxying without requiring privileged init containers. - [Concepts](https://developer.konghq.com/mesh/concepts.md): Understand the core concepts of Kong Mesh, including the control plane, data plane proxies, inbounds and outbounds, and resources like policies. - [Configure data plane proxy membership](https://developer.konghq.com/mesh/configure-data-plane-proxy-membership.md): Define requirements and restrictions for data plane proxies joining a mesh using membership constraints based on tags, namespaces, or zones. - [Kong Mesh control plane configuration](https://developer.konghq.com/mesh/control-plane-configuration.md): Learn how to configure the Kong Mesh control plane using environment variables or YAML, with details on store types (memory, Kubernetes, PostgreSQL) and configuration inspection. - [Kong Mesh data collection](https://developer.konghq.com/mesh/data-collection.md): Enable or disable data collection in Kong Mesh. Understand what telemetry is collected and how to configure reporting. - [Kong Mesh data plane on Kubernetes](https://developer.konghq.com/mesh/data-plane-kubernetes.md): Configure data plane proxies on Kubernetes with automatic sidecar injection, tag generation, and custom container settings. - [Authentication with the data plane proxy](https://developer.konghq.com/mesh/data-plane-proxy-authentication.md): Reference guide to authentication methods for data plane proxies in Kong Mesh, including Kubernetes service accounts, dataplane tokens, revocation, and offline token issuance. - [Kong Mesh data plane proxy](https://developer.konghq.com/mesh/data-plane-proxy.md): Understand data plane proxy components, Dataplane entities, inbounds, outbounds, tags, and how proxies receive configuration. - [Kong Mesh data plane on Universal](https://developer.konghq.com/mesh/data-plane-universal.md): Configure data plane proxies on VMs or bare metal with manual Dataplane resource definitions and lifecycle management. - [Kong Mesh data plane health](https://developer.konghq.com/mesh/dataplane-health.md): Learn about health mechanisms in Kong Mesh including circuit breakers, Service probes, and health checks for managing traffic based on Service health. - [Dataplane](https://developer.konghq.com/mesh/dataplane.md): Defines configuration for data plane proxies (sidecars) that handle service mesh traffic. - [Delegated gateways](https://developer.konghq.com/mesh/delegated-gateways.md): Guide to configuring delegated gateways in Kong Mesh, allowing external API gateways to handle ingress while Kong Mesh manages egress to the mesh. - [Kong Mesh disaster recovery](https://developer.konghq.com/mesh/disaster-recovery.md): Learn how to set up multi zone services to deal with zone-to-zone communication, failover, and disaster recovery. - [DNS](https://developer.konghq.com/mesh/dns.md): Learn how Kong Mesh DNS works with virtual IPs and service naming to enable transparent proxying. - [Kong Mesh on Amazon ECS](https://developer.konghq.com/mesh/ecs.md): Learn how to deploy Kong Mesh on Amazon ECS with IAM-based authentication and Universal mode support for Fargate and EC2. - [Enterprise features](https://developer.konghq.com/mesh/enterprise.md): Explore the features included with Kong Mesh Enterprise, including mTLS backends, RBAC, FIPS support, and signed container images. - [Configuring built-in routes with MeshHTTPRoute and MeshTCPRoute](https://developer.konghq.com/mesh/gateway-routes.md): Reference for configuring HTTP and TCP routing through built-in gateways using MeshHTTPRoute and MeshTCPRoute, including hostname matching and weighted backends. - [Kong Mesh](https://developer.konghq.com/mesh/guides.md): Learn how Kong Mesh works and how to configure it. - [HostnameGenerator](https://developer.konghq.com/mesh/hostnamegenerator.md): Customize hostnames for MeshService resources using templated HostnameGenerator resources. - [Konnect Kong Mesh deployment to Terraform](https://developer.konghq.com/mesh/import-konnect-deployment-to-terraform.md): This guide explains how to import an existing Konnect Kong Mesh deployment into Terraform. - [Ingress traffic with Kong Mesh](https://developer.konghq.com/mesh/ingress.md): Overview of how ingress (north/south) traffic flows through delegated and built-in gateways in Kong Mesh. - [Interacting with the Kong Mesh control plane](https://developer.konghq.com/mesh/interact-with-control-plane.md): Access and interact with the control plane using the UI, HTTP API, kumactl, or kubectl, and understand the ports exposed by each control plane mode. - [IPv6 support](https://developer.konghq.com/mesh/ipv6-support.md): Learn how to enable or disable IPv6 support in Kong Mesh. - [Kong Mesh in Konnect](https://developer.konghq.com/mesh/konnect.md): Learn how Kong Mesh works with Konnect: a Kong-managed global control plane, self-managed zones, and how zones connect and authenticate. - [Kubernetes built-in gateways with Kong Mesh](https://developer.konghq.com/mesh/kubernetes-gateway-api.md): Learn how to use Kubernetes Gateway API with Kong Mesh, including support for built-in gateways, HTTP/TCP routing, TLS, GAMMA, and multi-zone limitations. - [Kong Mesh license](https://developer.konghq.com/mesh/license.md): Understand how licensing works in Kong Mesh, including limits, behaviors, and how to apply a license in both Kubernetes and Universal modes. - [Manage control plane permissions on Kubernetes](https://developer.konghq.com/mesh/manage-control-plane-permissions-on-kubernetes.md): This guide explains how to manage control plane permissions on Kubernetes - [Managing secrets in Kong Mesh](https://developer.konghq.com/mesh/manage-secrets.md): Store and manage secrets securely in Kong Mesh, including mesh-scoped and global-scoped secrets for use in mTLS, policies, and external services. - [Configuring your mesh and multi-tenancy](https://developer.konghq.com/mesh/mesh-multi-tenancy.md): Learn how to create and configure isolated service meshes using the Mesh resource in Kong Mesh, supporting multi-tenancy and gradual adoption. - [Multi-zone deployment](https://developer.konghq.com/mesh/mesh-multizone-service-deployment.md): Group equivalent MeshServices across zones and expose a unified, zone-agnostic service with global failover capabilities. - [Mesh resource](https://developer.konghq.com/mesh/mesh.md): Reference for the Mesh resource, the root resource that defines service mesh instances with mTLS, networking, routing, and observability configuration. - [MeshExternalService](https://developer.konghq.com/mesh/meshexternalservice.md): Declare external resources that services in the mesh can consume, enabling TLS, routing, and hostname customization. - [Configuring built-in listeners with MeshGateway](https://developer.konghq.com/mesh/meshgateway.md): Reference for configuring built-in listeners using MeshGateway, including listener setup, TLS termination, hostnames, and cross-mesh support. - [Running built-in gateway pods on Kubernetes with MeshGatewayInstance](https://developer.konghq.com/mesh/meshgatewayinstance.md): Guide to running built-in gateway pods with MeshGatewayInstance in Kubernetes and customizing deployments and services. - [MeshMultiZoneService](https://developer.konghq.com/mesh/meshmultizoneservice.md): Group MeshServices across zones into a single multi-zone service with zone-agnostic hostnames and load balancing. - [MeshOpenTelemetryBackend](https://developer.konghq.com/mesh/meshopentelemetrybackend.md): Shared OpenTelemetry collector configuration that MeshMetric, MeshTrace, and MeshAccessLog can reference instead of duplicating endpoint settings. - [MeshService](https://developer.konghq.com/mesh/meshservice.md): Define and manage Services within the mesh, replacing kuma.io/service tags for clearer Service targeting and routing. - [Multi-zone authentication](https://developer.konghq.com/mesh/multi-zone-authentication.md): Use Control Plane scoped tokens to authenticate zone Control Planes in a multi-zone Kong Mesh deployment. - [Observability](https://developer.konghq.com/mesh/observability.md): Learn how to configure observability in Kong Mesh using Prometheus, Grafana, Jaeger, Loki, and Datadog. - [Get started with Red Hat OpenShift and Kong Mesh](https://developer.konghq.com/mesh/openshift-quickstart.md): This guide explains how to get started on Kong Mesh with Red Hat OpenShift, including installation, sidecar setup, and running a demo app. - [Performance fine-tuning](https://developer.konghq.com/mesh/performance-tuning.md): Reference guide to performance tuning in Kong Mesh, including configuration trimming, PostgreSQL tuning, XDS snapshot generation, profiling, and Envoy concurrency. - [Policies](https://developer.konghq.com/mesh/policies-introduction.md): Learn how to write and configure policies in Kong Mesh, including policy roles, targetRef, and merging strategies. - [Mesh Policies Hub](https://developer.konghq.com/mesh/policies.md): Bundled features for your service traffic and network configuration. - [ExternalService Policy](https://developer.konghq.com/mesh/policies/external-services.md): The ExternalService policy allows services running inside the mesh to consume services that are not part of the mesh. - [ExternalService: ExternalService Accessible from specific zone through ZoneEgress](https://developer.konghq.com/mesh/policies/external-services/examples/accessible-from-specific-zone-through-zoneegress.md): ExternalService Accessible from specific zone through ZoneEgress - [ExternalService: ExternalService and ZoneEgress](https://developer.konghq.com/mesh/policies/external-services/examples/zone-egress.md): ExternalService and ZoneEgress - [ExternalService Policy Configuration Reference](https://developer.konghq.com/mesh/policies/external-services/reference.md): The ExternalService policy allows services running inside the mesh to consume services that are not part of the mesh. - [MeshAccessLogs Policy](https://developer.konghq.com/mesh/policies/meshaccesslog.md): Set up access logs on every data plane proxy in a mesh. - [MeshAccessLogs: Log all incoming traffic](https://developer.konghq.com/mesh/policies/meshaccesslog/examples/log-incoming-traffic.md): Log all incoming traffic with MeshAccessLog. - [MeshAccessLogs: Log all outgoing traffic](https://developer.konghq.com/mesh/policies/meshaccesslog/examples/log-outgoing-traffic.md): Log all outgoing traffic with MeshAccessLog. - [MeshAccessLogs: Logging to multiple backends](https://developer.konghq.com/mesh/policies/meshaccesslog/examples/logging-to-multiple-backends.md): This configuration logs to three backends: TCP, file and OpenTelemetry. - [MeshAccessLogs Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshaccesslog/reference.md): Set up access logs on every data plane proxy in a mesh. - [MeshCircuitBreakers Policy](https://developer.konghq.com/mesh/policies/meshcircuitbreaker.md): Look for errors in the live traffic between data plane proxies and mark a as unhealthy if conditions are met. - [MeshCircuitBreakers: Basic circuit breaker for outbound traffic](https://developer.konghq.com/mesh/policies/meshcircuitbreaker/examples/basic-circuit-breaker.md): Basic circuit breaker for outbound traffic from web, to backend service - [MeshCircuitBreakers: Outlier detection](https://developer.konghq.com/mesh/policies/meshcircuitbreaker/examples/inbound-traffic-backend-service.md): Outlier detection for inbound traffic to backend service - [MeshCircuitBreakers Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshcircuitbreaker/reference.md): Look for errors in the live traffic between data plane proxies and mark a as unhealthy if conditions are met. - [MeshFaultInjections Policy](https://developer.konghq.com/mesh/policies/meshfaultinjection.md): Test services for resiliency by introducing errors. - [MeshFaultInjections: Backend service with a list of faults that are applied for frontend service](https://developer.konghq.com/mesh/policies/meshfaultinjection/examples/list-faults-applied-from-frontend.md): Backend service with a list of faults that are applied for frontend service - [MeshFaultInjections: 50.5% of requests to service backend from any service is going to be delayed by 5 seconds](https://developer.konghq.com/mesh/policies/meshfaultinjection/examples/return-requests-delayed.md): 50.5% of requests to service backend from any service is going to be delayed by 5 seconds - [MeshFaultInjections: Service backend returns 500 for 50% of requests from frontend service](https://developer.konghq.com/mesh/policies/meshfaultinjection/examples/return-requests-from-frontend.md): Service backend returns 500 for 50% of requests from frontend service - [MeshFaultInjections Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshfaultinjection/reference.md): Test services for resiliency by introducing errors. - [MeshGlobalRateLimits Policy](https://developer.konghq.com/mesh/policies/meshglobalratelimit.md): Control the number of requests received by a service in a specific timeframe. - [MeshGlobalRateLimits: Rate limit the whole mesh](https://developer.konghq.com/mesh/policies/meshglobalratelimit/examples/global.md): Simplify your per service configuration, by configuring the ratelimit service backend for the whole mesh. - [MeshGlobalRateLimits Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshglobalratelimit/reference.md): Control the number of requests received by a service in a specific timeframe. - [MeshHealthChecks Policy](https://developer.konghq.com/mesh/policies/meshhealthcheck.md): Run health checks between Services and mark Dataplanes as unhealthy when they are unhealthy. - [MeshHealthChecks: gRPC health check from cart to payment service](https://developer.konghq.com/mesh/policies/meshhealthcheck/examples/grpcs-health-check-from-cart.md): gRPC health check from cart to payment service. - [MeshHealthChecks: Health check from web to backend service](https://developer.konghq.com/mesh/policies/meshhealthcheck/examples/health-check-backend.md): Health check from web to backend service - [MeshHealthChecks: Protocol fallback](https://developer.konghq.com/mesh/policies/meshhealthcheck/examples/protocol-fallback.md): Protocol fallback - [MeshHealthChecks Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshhealthcheck/reference.md): Run health checks between Services and mark Dataplanes as unhealthy when they are unhealthy. - [MeshHttpRoutes Policy](https://developer.konghq.com/mesh/policies/meshhttproute.md): Alter and redirect HTTP requests depending on where the request is coming from and where it's going to. - [MeshHttpRoutes: Traffic mirror](https://developer.konghq.com/mesh/policies/meshhttproute/examples/traffic-mirror.md): `MeshHTTPRoute` can mirror a fraction of requests to another service. - [MeshHttpRoutes: Traffic modification](https://developer.konghq.com/mesh/policies/meshhttproute/examples/traffic-modification.md): An example of a MeshHTTPRoute that adds x-custom-header with value xyz when frontend tries to consume backend. - [MeshHttpRoutes: Traffic split](https://developer.konghq.com/mesh/policies/meshhttproute/examples/traffic-split.md): Use MeshHTTPRoute to split an HTTP traffic between different MeshServices. - [MeshHttpRoutes Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshhttproute/reference.md): Alter and redirect HTTP requests depending on where the request is coming from and where it's going to. - [MeshIdentities Policy](https://developer.konghq.com/mesh/policies/meshidentity.md): Define how workloads obtain cryptographic identity with MeshIdentity, supporting SPIFFE IDs and multiple certificate providers. - [MeshIdentities: Minimal bundled MeshIdentity](https://developer.konghq.com/mesh/policies/meshidentity/examples/bundled-minimal.md): Apply a MeshIdentity policy with an autogenerated CA to all data plane proxies in the mesh. - [MeshIdentities: MeshIdentity with user-provided CA](https://developer.konghq.com/mesh/policies/meshidentity/examples/bundled-with-user-ca.md): Apply a MeshIdentity policy with a user-provided CA to a subset of data plane proxies. - [MeshIdentities: MeshIdentity with Spire provider](https://developer.konghq.com/mesh/policies/meshidentity/examples/spire-provider.md): Apply a MeshIdentity policy using the Spire certificate provider to all data plane proxies. - [MeshIdentities Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshidentity/reference.md): Define how workloads obtain cryptographic identity with MeshIdentity, supporting SPIFFE IDs and multiple certificate providers. - [MeshLoadBalancingStrategies Policy](https://developer.konghq.com/mesh/policies/meshloadbalancingstrategy.md): Configure the load balancing strategy for traffic between services in the mesh. - [MeshLoadBalancingStrategies: Disable cross-zone traffic](https://developer.konghq.com/mesh/policies/meshloadbalancingstrategy/examples/disable-cross-zone-traffic.md): Disable cross zone traffic and prioritize traffic the dataplanes on the same node and availability zone - [MeshLoadBalancingStrategies: Disable locality-aware load balancing for backend](https://developer.konghq.com/mesh/policies/meshloadbalancingstrategy/examples/disable-locality-aware.md): Requests to `backend` will be spread evenly across all zones where `backend` is deployed. - [MeshLoadBalancingStrategies: Load balance from HTTP header](https://developer.konghq.com/mesh/policies/meshloadbalancingstrategy/examples/load-balancing-http-traffic.md): Load balance requests from `frontend` to `backend` based on the HTTP header `x-header` - [MeshLoadBalancingStrategies: Prioritize traffic to data planes in specific order](https://developer.konghq.com/mesh/policies/meshloadbalancingstrategy/examples/prioritize-traffic-to-data-planes.md): Requests to backend will be distributed based on weights, with 99.9% of requests routed to data planes in the same data center, 0.099% to data planes in the same region, and the remainder to other local instances. - [MeshLoadBalancingStrategies: Route to the local zone instances equally](https://developer.konghq.com/mesh/policies/meshloadbalancingstrategy/examples/route-equally.md): In this example, when a user sends a request to the backend service, the request is routed equally to all instances in the local zone. If there are no instances in the local zone, the request will fail because there is no cross zone traffic. - [MeshLoadBalancingStrategies Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshloadbalancingstrategy/reference.md): Configure the load balancing strategy for traffic between services in the mesh. - [MeshMetrics Policy](https://developer.konghq.com/mesh/policies/meshmetric.md): Gather traffic metrics across all data plane proxies in the mesh. - [MeshMetrics: Metrics default](https://developer.konghq.com/mesh/policies/meshmetric/examples/default.md): A default `MeshMetric` policy for the `default` mesh - [MeshMetrics Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshmetric/reference.md): Gather traffic metrics across all data plane proxies in the mesh. - [meshopas Policy](https://developer.konghq.com/mesh/policies/meshopa.md): Integrate Open Policy Agent (OPA) to provide access control for your Services. - [meshopas: Support-for-external-API](https://developer.konghq.com/mesh/policies/meshopa/examples/support-for-external-api.md): The `agentConfig` field lets you define a custom configuration that points to an external management server - [meshopas Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshopa/reference.md): Integrate Open Policy Agent (OPA) to provide access control for your Services. - [meshpassthroughs Policy](https://developer.konghq.com/mesh/policies/meshpassthrough.md): Configure traffic to external destinations that is allowed to pass outside the mesh. - [meshpassthroughs: Disable passthrough](https://developer.konghq.com/mesh/policies/meshpassthrough/examples/disable-passthrough.md): Disables pasthrough for all sidecars - [meshpassthroughs: Enable passthrough](https://developer.konghq.com/mesh/policies/meshpassthrough/examples/enable-passthrough.md): Enable pasthrough for all sidecars - [meshpassthroughs: Allow services to communicate with external endpoints](https://developer.konghq.com/mesh/policies/meshpassthrough/examples/passthrough-specific-endpoints.md): Allow a subset of services to communicate with specific external endpoints - [meshpassthroughs Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshpassthrough/reference.md): Configure traffic to external destinations that is allowed to pass outside the mesh. - [MeshProxyPatches Policy](https://developer.konghq.com/mesh/policies/meshproxypatch.md): Configuration low-level options for Envoy resources that Kong Mesh policies do not directly expose. - [MeshProxyPatches: Lua filter](https://developer.konghq.com/mesh/policies/meshproxypatch/examples/lua-filter.md): Adds the new x-header: test header to all outgoing HTTP requests to service offers - [MeshProxyPatches: Timeout adjustment for MeshGateway](https://developer.konghq.com/mesh/policies/meshproxypatch/examples/time-out-adjustment.md): Example how to change `streamIdleTimeout` for `MeshGateway` - [MeshProxyPatches Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshproxypatch/reference.md): Configuration low-level options for Envoy resources that Kong Mesh policies do not directly expose. - [MeshRateLimits Policy](https://developer.konghq.com/mesh/policies/meshratelimit.md): Enable per-instance service request limiting. Supports rate limiting of HTTP/HTTP2 requests and TCP connections. - [MeshRateLimits: Configure on Services](https://developer.konghq.com/mesh/policies/meshratelimit/examples/configure-on-services.md): Use MeshHTTPRoute to split an HTTP traffic between different MeshServices. - [MeshRateLimits: TCP rate limiting](https://developer.konghq.com/mesh/policies/meshratelimit/examples/tcp-rate-limit.md): TCP rate limit for service backend from all services in the Mesh - [MeshRateLimits Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshratelimit/reference.md): Enable per-instance service request limiting. Supports rate limiting of HTTP/HTTP2 requests and TCP connections. - [MeshRetries Policy](https://developer.konghq.com/mesh/policies/meshretry.md): Configure retry behaviour for HTTP, gRPC and TCP protocols. - [MeshRetries: gRPC frontend to backend on DeadlineExceeded](https://developer.konghq.com/mesh/policies/meshretry/examples/deadlineexceeded.md): gRPC frontend to backend on DeadlineExceeded - [MeshRetries: Route 5xx requests to backend](https://developer.konghq.com/mesh/policies/meshretry/examples/http-frontend-to-backend.md): HTTP frontend to backend on 5xx - [MeshRetries: gRPC frontend to backend on DeadlineExceeded](https://developer.konghq.com/mesh/policies/meshretry/examples/tcp-frontend-to-backend.md): gRPC frontend to backend on DeadlineExceeded - [MeshRetries Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshretry/reference.md): Configure retry behaviour for HTTP, gRPC and TCP protocols. - [MeshTCPRoutes Policy](https://developer.konghq.com/mesh/policies/meshtcproute.md): Alter and redirect TCP requests depending on where the request is coming from and where it’s going to. - [MeshTCPRoutes: Traffic redirection](https://developer.konghq.com/mesh/policies/meshtcproute/examples/traffic-redirection.md): You can use `MeshTCPRoute` to redirect outgoing traffic from one service to another. - [MeshTCPRoutes: Traffic split](https://developer.konghq.com/mesh/policies/meshtcproute/examples/traffic-split.md): Use MeshHTTPRoute to split TCP traffic between different MeshServices. - [MeshTCPRoutes Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshtcproute/reference.md): Alter and redirect TCP requests depending on where the request is coming from and where it’s going to. - [MeshTimeouts Policy](https://developer.konghq.com/mesh/policies/meshtimeout.md): Specify the amount of time Dataplane will wait for a connection to be established. - [MeshTimeouts: Simple configuration for inbound applied to specific service](https://developer.konghq.com/mesh/policies/meshtimeout/examples/backend-inbound.md): This configuration will be applied to `backend` service inbound. - [MeshTimeouts: Default configuration](https://developer.konghq.com/mesh/policies/meshtimeout/examples/default-all-gateways.md): This configuration will be applied on inbounds and outbounds of all gateways - [MeshTimeouts: Simple outbound HTTP configuration](https://developer.konghq.com/mesh/policies/meshtimeout/examples/http-config.md): This configuration will be applied to all data plane proxies inside of Mesh. - [MeshTimeouts: Target `MeshHTTPRoute`](https://developer.konghq.com/mesh/policies/meshtimeout/examples/target-mesh-httproute.md): the `MeshHTTPRoute` policy `route-to-backend-v2` redirects all requests to `/v2*` to `backend` instances with `version: v2` tag. `MeshTimeout` `backend-v2` configures timeouts only for requests that are going through `route-to-backend-v2` route. - [MeshTimeouts: Simple outbound TCP configuration](https://developer.konghq.com/mesh/policies/meshtimeout/examples/tcp-config.md): This configuration will be applied to all data plane proxies inside of Mesh. - [MeshTimeouts: Configuration for a single inbound port named `tcp-port`](https://developer.konghq.com/mesh/policies/meshtimeout/examples/tcp-port.md): Configuration for a single inbound port named `tcp-port` - [MeshTimeouts: Full config applied to inbound and outbound of specific service](https://developer.konghq.com/mesh/policies/meshtimeout/examples/timeout-all-services.md): This timeout configuration will be applied to all inbound connections to `frontend` and outbound connections from `frontend` to `backend` service - [MeshTimeouts Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshtimeout/reference.md): Specify the amount of time Dataplane will wait for a connection to be established. - [MeshTLSes Policy](https://developer.konghq.com/mesh/policies/meshtls.md): Configure TLS mode, ciphers and version. Backends and default mode values are taken from the Mesh object. - [MeshTLSes: Set specific TLS version and ciphers](https://developer.konghq.com/mesh/policies/meshtls/examples/set-specific-tls-version.md): Set specific TLS version and ciphers - [MeshTLSes: Enable strict mode on specific subset](https://developer.konghq.com/mesh/policies/meshtls/examples/strict-mode.md): Enable strict mode on specific subset - [MeshTLSes Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshtls/reference.md): Configure TLS mode, ciphers and version. Backends and default mode values are taken from the Mesh object. - [MeshTraces Policy](https://developer.konghq.com/mesh/policies/meshtrace.md): Publish traces to a third party tracing solution. - [MeshTraces: Datadog](https://developer.konghq.com/mesh/policies/meshtrace/examples/datadog.md): This assumes a Datadog agent is configured and running. If you haven't already check the [Datadog observability page](/docs//explore/observability#configuring-datadog). - [MeshTraces: OpenTelemetry](https://developer.konghq.com/mesh/policies/meshtrace/examples/opentelemetry.md): This assumes a OpenTelemetry collector is configured and running. If you haven't already check the [OpenTelementry operator](https://github.com/open-telemetry/opentelemetry-operator). - [MeshTraces: Targeting parts of the infrastructure: East only](https://developer.konghq.com/mesh/policies/meshtrace/examples/target-east.md): To do this, we use a `TargetRef` kind value of `MeshSubset` to filter which data plane proxy a policy applies to. - [MeshTraces: Targeting parts of the infrastructure: West Only](https://developer.konghq.com/mesh/policies/meshtrace/examples/target-west.md): To do this, we use a `TargetRef` kind value of `MeshSubset` to filter which data plane proxy a policy applies to. - [MeshTraces: Zipkin](https://developer.konghq.com/mesh/policies/meshtrace/examples/zipkin.md): Zipkin full example - [MeshTraces Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshtrace/reference.md): Publish traces to a third party tracing solution. - [MeshTrafficPermissions Policy](https://developer.konghq.com/mesh/policies/meshtrafficpermission.md): Define what services can talk to other services. - [MeshTrafficPermissions: Allow traffic to a service](https://developer.konghq.com/mesh/policies/meshtrafficpermission/examples/service-allow-requests.md): Use MeshTrafficPermission to allow traffic to a specific MeshService. - [MeshTrafficPermissions Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshtrafficpermission/reference.md): Define what services can talk to other services. - [MeshTrafficPermissions Policy](https://developer.konghq.com/mesh/policies/meshtrafficpermission_experimental.md): Control service-to-service access using SPIFFE identities with allow, deny, and shadow deny rules. - [MeshTrafficPermissions: Allow traffic from a namespace](https://developer.konghq.com/mesh/policies/meshtrafficpermission_experimental/examples/allow-observability-namespace.md): Use MeshTrafficPermission to allow requests from every workload in a namespace by matching a SPIFFE ID prefix. - [MeshTrafficPermissions: Deny traffic from a namespace](https://developer.konghq.com/mesh/policies/meshtrafficpermission_experimental/examples/deny-malicious-namespace.md): Use MeshTrafficPermission to deny requests from every workload in a namespace by matching a SPIFFE ID prefix. - [MeshTrafficPermissions: Override a mesh-wide allow rule on a service port](https://developer.konghq.com/mesh/policies/meshtrafficpermission_experimental/examples/deny-observability-on-backend-admin-api.md): Use MeshTrafficPermission to deny traffic from a namespace on a specific service port, even when a mesh-wide allow rule exists. - [MeshTrafficPermissions Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshtrafficpermission_experimental/reference.md): Control service-to-service access using SPIFFE identities with allow, deny, and shadow deny rules. - [MeshTrusts Policy](https://developer.konghq.com/mesh/policies/meshtrust.md): Enable mesh applications to accept encrypted mTLS traffic from different trust domains using certificate bundles. - [MeshTrusts: Allow encrypted traffic from a different trust domain](https://developer.konghq.com/mesh/policies/meshtrust/examples/allow-encrypted-traffic.md): Allow encrypted mTLS traffic from a different trust domain to the mesh using a PEM certificate bundle. - [MeshTrusts Policy Configuration Reference](https://developer.konghq.com/mesh/policies/meshtrust/reference.md): Enable mesh applications to accept encrypted mTLS traffic from different trust domains using certificate bundles. - [Configuring Mutual TLS](https://developer.konghq.com/mesh/policies/mutual-tls.md): Reference for configuring mutual TLS in Kong Mesh, including CA backends and certificate rotation. - [Deploy Kong Mesh in production with Helm](https://developer.konghq.com/mesh/production-usage-values.md): Deploy a production-grade Kong Mesh installation on Kubernetes using Helm charts for single zone, multi-zone, or federated environments. - [Verify build provenance for Kong Mesh binaries](https://developer.konghq.com/mesh/provenance-verification-binaries.md): Verify the build provenance of signed Kong Mesh binary artifacts. - [Verify build provenance for signed Kong Mesh images](https://developer.konghq.com/mesh/provenance-verification-images.md): Learn how to verify build provenance for signed Kong Mesh Docker container images using Cosign or slsa-verifier. - [Role-based access control](https://developer.konghq.com/mesh/rbac.md): Use AccessRole and AccessRoleBinding resources in Kong Mesh to implement fine-grained, role-based access to policies and actions. - [kuma-cp configuration reference](https://developer.konghq.com/mesh/reference/kuma-cp.md): Configuration reference for the Kong Mesh control plane - [Kong Mesh resource sizing guidelines](https://developer.konghq.com/mesh/resource-sizing-guidelines.md): Learn about control plane and sidecar container sizing guidelines for Kong Mesh. - [Software Bill of Materials](https://developer.konghq.com/mesh/sbom.md): View and download software bill of materials (SBOMs) for Kong Mesh binaries and Docker images, including license, dependency, and security information. - [Secure access across services](https://developer.konghq.com/mesh/secure-access.md): Learn how Kong Mesh secures communication between data plane proxies, control planes, and users, including TLS configuration and certificate management across deployments. - [Service discovery](https://developer.konghq.com/mesh/service-discovery.md): Learn how data plane proxies connect to the control plane and discover Service endpoints for traffic routing. - [Service meshes](https://developer.konghq.com/mesh/service-mesh.md): Overview of service mesh concepts and how Kong Mesh simplifies secure and reliable service-to-service communication using sidecar proxies and a control plane. - [Verify signatures for signed Kong Mesh images](https://developer.konghq.com/mesh/signed-images.md): Learn how to verify signed Kong Mesh Docker images using Cosign and GitHub OIDC identity for increased trust. - [Single-zone deployment](https://developer.konghq.com/mesh/single-zone.md): Run Kong Mesh in a single zone with a standalone control plane and interconnected data plane proxies. - [Kong Mesh version support policy](https://developer.konghq.com/mesh/support-policy.md): Understand the lifecycle and version support guidelines for Kong Mesh, including supported release timelines. - [Configuring systemd for Kong Mesh](https://developer.konghq.com/mesh/systemd.md): Configure systemd unit files to manage the control plane and data plane proxy processes on VMs. - [Targeting MeshHTTPRoutes in supported policies](https://developer.konghq.com/mesh/targeting-meshhttproutes-in-supported-policies.md): Target `MeshHTTPRoutes` in policies like `MeshTimeout`, `MeshAccessLog`, and `MeshRetry` for precise traffic control. - [Transparent proxying with Kong Mesh](https://developer.konghq.com/mesh/transparent-proxying.md): Explains how transparent proxying in Kong Mesh works using iptables, including inbound and outbound traffic flow with Envoy. - [Red Hat Universal Base Images](https://developer.konghq.com/mesh/ubi-images.md): Use Red Hat Universal Base Images (UBI) for running Kong Mesh components, available alongside standard Alpine-based images. - [Upgrade Kong Mesh](https://developer.konghq.com/mesh/upgrade.md): Reference guide for upgrading Kong Mesh across versions. Covers compatibility rules, upgrade order, and considerations for single-zone and multi-zone deployments. - [Kong Mesh validated versions](https://developer.konghq.com/mesh/validated-versions.md): Learn about the versions of Kubernetes and Envoy validated against Kong Mesh. - [HashiCorp Vault CA](https://developer.konghq.com/mesh/vault.md): Configure Kong Mesh to use HashiCorp Vault as a Certificate Authority for mTLS, including setup steps and authentication options. - [Version-specific upgrade notes for Kong Mesh](https://developer.konghq.com/mesh/version-specific-upgrade-notes.md): Instructions for upgrades to specific Kong Mesh versions. - [Kong Mesh vulnerability patching process](https://developer.konghq.com/mesh/vulnerability-patching-process.md): Understand how Kong addresses and patches vulnerabilities in Kong Mesh binaries, third-party dependencies, and Docker images. - [Workload](https://developer.konghq.com/mesh/workload.md): Reference for the Workload resource, which represents a logical grouping of data plane proxies with status reporting for connected and healthy instances. - [Zone egress](https://developer.konghq.com/mesh/zone-egress.md): Configure ZoneEgress proxies to isolate outgoing traffic to other zones or external services. - [Kong Mesh zone ingress](https://developer.konghq.com/mesh/zone-ingress.md): Configure ZoneIngress proxies to enable cross-zone communication in multi-zone deployments. - [Zone proxy authentication](https://developer.konghq.com/mesh/zone-proxy-auth.md): Learn about authentication for zone proxies using service account tokens or zone tokens for secure control plane communication. - [Kong Mesh: 'admission webhook "validator.kuma-admission.kuma.io" denied the request: access denied' error when the default AccessRole or AccessRoleBinding is missing or too restrictive](https://developer.konghq.com/support/kong-mesh-error-admission-webhook-validator-kuma-admission-kuma-io-denied-the-request-access-denied-user-gruber-system-masters-system-authenticated-cannot-access-the-resource.md): Kong Mesh denies valid users from creating resources when the default `AccessRole` and `AccessRoleBinding` are missing or too restrictive; recreating them and the validating webhook resolves the access-denied error. - [Kong Mesh: Receiving error "license status is not valid for this control plane. Copy ConfigMap license-quota-status"](https://developer.konghq.com/support/kong-mesh-receiving-error-license-status-is-not-valid-for-this-control-plane-copy-configmap-license-quota-status.md): A Kong Mesh Zone Control Plane can lose license validity when the `license-quota-status` ConfigMap is out of sync with the Global CP; deleting the ConfigMap and letting it rebuild resolves the error. - [Kong Mesh: Unable to generate certificate using Vault policy, error: "permission denied - use token that allows to generate cert"](https://developer.konghq.com/support/kong-mesh-unable-to-generate-certificate-using-vault-policy-error-permission-denied-use-token-that-allows-to-generate-cert.md): Kong Mesh can fail to generate certificates through Vault Policy when a Hashicorp Vault child token's parent token has a shorter TTL, causing `permission denied` errors; extending the parent TTL or switching to an orphan token resolves it. ## Kong Operator - [Kong Operator](https://developer.konghq.com/operator.md): Kong Operator is the Kubernetes-native way to interact with Kong. Deploy data planes, configure Konnect, and more. - [Kong Operator Changelog](https://developer.konghq.com/operator/changelog.md): New features, bug fixes and breaking changes for Kong Operator - [Dump server](https://developer.konghq.com/operator/control-planes/config-dump-server.md): Use the dump config server to inspect and debug Kong configurations generated by the Kong Operator for each control plane. - [Enterprise license](https://developer.konghq.com/operator/dataplanes/faq/license.md): Provide your Kong Gateway license using the KongLicense CRD or as an environment variable - [Gateway API](https://developer.konghq.com/operator/dataplanes/gateway-api.md): Understand how Kong Operator interacts with Gateway API resources - [Gateway configuration](https://developer.konghq.com/operator/dataplanes/gateway-configuration.md): Customize your Kong Gateway deployments when using the Gateway resource - [KonnectExtension](https://developer.konghq.com/operator/dataplanes/konnectextension.md): Automatically register data planes with Konnect by providing authentication credentials in KonnectExtension - [Managed Gateways](https://developer.konghq.com/operator/dataplanes/managed-gateways.md): Learn how Kong Operator reconciles `Gateway` resources, automatically configuring listeners as needed - [Autoscaling Kong Gateway](https://developer.konghq.com/operator/dataplanes/reference/autoscale-gateway.md): Horizontally scale Kong Gateway based on CPU usage - [Autoscaling workloads](https://developer.konghq.com/operator/dataplanes/reference/autoscale-workloads.md): Scale your Kubernetes workloads using latency information from Kong Gateway - [Kong Operator metrics](https://developer.konghq.com/operator/dataplanes/reference/metrics/operator.md): See which metrics Kong Operator exposes and learn how to authenticate using a ServiceAccount to scrape the values - [PodDisruptionBudget](https://developer.konghq.com/operator/dataplanes/reference/poddisruptionbudget.md): Control the number of available pods during a rollout - [PodTemplateSpec](https://developer.konghq.com/operator/dataplanes/reference/podtemplatespec.md): Customize your ControlPlane and DataPlane deployments. Supports images, volume mounts, node affinity and more - [Service annotations](https://developer.konghq.com/operator/dataplanes/reference/service-annotations.md): Configure upstream behavior such as timeouts, retries, host header, and TLS by annotating Kubernetes Services exposed through an HTTPRoute. - [Status](https://developer.konghq.com/operator/dataplanes/troubleshooting/status.md): Inspect resource statuses to see detailed information about Kong Operator resources - [Blue/green upgrades for Kong Gateway](https://developer.konghq.com/operator/dataplanes/upgrade/gateway/blue-green.md): Create a new Kong Gateway Service any time your deployment changes, then promote it to be live after testing - [Rolling upgrades for Kong Gateway](https://developer.konghq.com/operator/dataplanes/upgrade/gateway/rolling.md): Automatically terminate existing pods as new ones become ready - [Upgrade Kong Operator](https://developer.konghq.com/operator/dataplanes/upgrade/operator.md): Understand how Kong Operator versioning works, what to check before upgrading, and version-specific upgrade notes - [Install Kong Operator](https://developer.konghq.com/operator/install.md): Install Kong Operator using Helm - [Kong AI Gateway with Kong Operator](https://developer.konghq.com/operator/konnect/ai-gateway.md): Understand the Kubernetes resources that make up an Kong AI Gateway deployment managed by Kong Operator - [Config Store-backed Vaults](https://developer.konghq.com/operator/konnect/config-store.md): How does a KongVault reference a KonnectConfigStore, and where do the secrets it holds actually live? - [Cross namespace references](https://developer.konghq.com/operator/konnect/cross-namespace-references.md): How do I use cross namespace references with Kong Operator? - [Kong Event Gateway with Kong Operator](https://developer.konghq.com/operator/konnect/event-gateway.md): Deploy and validate Kong Event Gateway resources with Kong Operator - [Understanding KongPluginBinding](https://developer.konghq.com/operator/konnect/kongpluginbinding.md): What is KongPluginBinding, and how does it interact with the konghq.com/plugins annotation? - [Labelling and Tagging resources](https://developer.konghq.com/operator/konnect/labelling.md): How do I add additional metadata to entities managed by Kong Operator? - [Reconciliation loop](https://developer.konghq.com/operator/konnect/reconciliation-loop.md): How does the Kong Operator reconciliation loop work? - [FAQ](https://developer.konghq.com/operator/konnect/reference/faq.md): Answers to common questions about managing Konnect entities using the Operator. - [Migrate Konnect DataPlanes from Kong Gateway Operator 1.4 to 1.5](https://developer.konghq.com/operator/konnect/reference/migrate-1.4-1.5.md): How do I migrate from Kong Gateway Operator 1.4 to 1.5, taking in to account breaking changes? - [Status Fields](https://developer.konghq.com/operator/konnect/troubleshooting/status.md): How do I find out why my resources aren't being reconciled against Konnect? - [Migrate KonnectExtension from konnectID to KonnectGatewayControlPlane](https://developer.konghq.com/operator/migrate/konnectextension-konnectid-to-konnectgatewaycontrolplane.md): Learn how to migrate your KonnectExtension resources to KonnectGatewayControlPlane before upgrading to KO 2.0.0. - [Migrating from Kong Gateway Operator 1.6.x to Kong Operator 2.0.0](https://developer.konghq.com/operator/migrate/migrate-1.6.x-2.0.0.md): Complete migration guide from Kong Operator (KGO) 1.6.x to Kong Operator (KO) 2.0.0. - [Migrating from Kong Ingress Controller to Kong Operator 2.0.0](https://developer.konghq.com/operator/migrate/migrate-kic-to-ko.md): Complete migration guide from Kong Ingress Controller (KIC) to Kong Operator (KO) 2.0.0. - [Kong Operator architecture](https://developer.konghq.com/operator/reference/architecture.md): Learn about the Kong Operator architecture with a self-hosted control plane or with Konnect, for single-tenant and multi-tenant deployments. - [Kong Operator configuration options](https://developer.konghq.com/operator/reference/configuration-options.md): Learn about the various settings and configurations of the operator which can be tweaked using CLI flags. - [Kong Operator ControlPlane feature gates and controllers](https://developer.konghq.com/operator/reference/control-plane-feature-gates-and-controllers.md): Configure feature gates and controllers for Kong ControlPlane in Kong Operator - [Limiting namespaces watched by ControlPlane](https://developer.konghq.com/operator/reference/control-plane-watch-namespaces.md): Learn how to limit the namespaces that ControlPlane watches. - [Custom resource definitions](https://developer.konghq.com/operator/reference/custom-resources.md): Explore schemas of the available Custom Resources for Kong Operator - [HTTP proxy configuration](https://developer.konghq.com/operator/reference/http-proxy.md): Configure Kong Operator to route outbound traffic through an HTTP proxy using standard Go environment variables. - [LabelSelectors](https://developer.konghq.com/operator/reference/labelselectors.md): Use label selectors to limit which Secrets and ConfigMaps are reconciled, reducing the number of objects cached by Kong Operator - [Multi-tenancy](https://developer.konghq.com/operator/reference/multi-tenancy.md): Understand how to run multiple isolated Kong Gateway instances on the same Kubernetes cluster using Kong Operator. - [Kubernetes Secrets with Kong Operator](https://developer.konghq.com/operator/reference/secrets.md): Reference guide for configuring Kubernetes Secrets with Kong Operator. - [Version compatibility](https://developer.konghq.com/operator/reference/version-compatibility.md): Understand which versions of Kubernetes and the Gateway API Kong Operator works with - [Kong Operator version support policy](https://developer.konghq.com/operator/support-policy.md): Check if your version of Kong Operator is supported ## Konnect Platform - [Konnect API Errors OpenAPI Specification](https://developer.konghq.com/api/errors.md): Documentation on common API errors when working with Kong products - [AWS PrivateLink peering](https://developer.konghq.com/gateway/aws-private-link.md): Create a private connection between your AWS environment and Konnect using AWS PrivateLink. - [Migrating from self-managed Kong Gateway to Konnect](https://developer.konghq.com/gateway/self-managed-migration.md): Learn how to migrate from self-managed Kong Gateway to Konnect. - [Konnect APIs](https://developer.konghq.com/konnect-api.md): This page is an introduction to the Konnect APIs. - [Konnect account, pricing, and organization deactivation](https://developer.konghq.com/konnect-platform/account.md): Learn how to cancel and deactivate an account in Konnect - [Konnect and Dev Portal audit logs](https://developer.konghq.com/konnect-platform/audit-logs.md): Review logs for system events in Konnect and Dev Portal. - [Konnect platform authentication and authorization](https://developer.konghq.com/konnect-platform/authentication.md): Secure your Kong Konnect organization by setting up teams and roles, or enable an external authenticator to manage Kong Konnect authentication and authorization from your own identity provider. - [Customer-Managed Encryption Keys (CMEK)](https://developer.konghq.com/konnect-platform/cmek.md): Use Customer-Managed Encryption Keys (CMEK) in Konnect to encrypt pre-determined sets of sensitive data using keys from your AWS Key Management Service (KMS) account. - [Konnect compatibility and support policy](https://developer.konghq.com/konnect-platform/compatibility.md): Details which browsers, software, and versions Konnect is compatible with. - [Geographic regions](https://developer.konghq.com/konnect-platform/geos.md): Konnect allows you to host and operate your cloud instance in a geographic region that you specify. This may be important for data privacy and regulatory compliance for your organization. - [Kong AI assistant (KAi)](https://developer.konghq.com/konnect-platform/kai.md): Learn how to use Kong's AI assistant, KAi. - [Kong Konnect MCP Server](https://developer.konghq.com/konnect-platform/konnect-mcp.md): Interact with Kong Konnect through AI clients using MCP tools. - [Install Kong Konnect MCP Server](https://developer.konghq.com/konnect-platform/konnect-mcp/installation.md): Configure the Kong Konnect MCP Server with AI assistants and IDE copilots including Claude Code CLI, VS Code, Cursor, and GitHub Copilot. - [Networking in Konnect](https://developer.konghq.com/konnect-platform/network.md): Learn about control plane and data plane networking information like ports, hostnames, and communication in Konnect. - [Notifications in Konnect](https://developer.konghq.com/konnect-platform/notification-hub.md): Konnect’s Notification Hub keeps you up to date on critical events across your organization. - [IdP SAML attribute mapping reference](https://developer.konghq.com/konnect-platform/saml-idp-mapping.md): Attribute mapping tables necessary for configuring SSO with SAML - [Konnect Search reference](https://developer.konghq.com/konnect-platform/search.md): Learn how to use the Konnect Search to search through all Konnect entities. - [Konnect SSO](https://developer.konghq.com/konnect-platform/sso.md): Learn how to configure single sign-on (SSO) for the Konnect platform. - [Konnect teams and roles](https://developer.konghq.com/konnect-platform/teams-and-roles.md): Konnect has the ability to create teams and roles within an organization and use them to distribute permissions. - [Konnect](https://developer.konghq.com/konnect.md): About the Konnect SaaS API platform - [konnect-access-scope](https://developer.konghq.com/skills/konnect-access-scope.md): Troubleshoot Konnect operator access and visibility. Use when a user cannot authenticate, cannot see or edit a Konnect resource, may be in the wrong region, org, or team, or needs help with scoped roles or IdP-managed access. Not for Dev Portal app auth. - [konnect-ai-gateway](https://developer.konghq.com/skills/konnect-ai-gateway.md): Operate Konnect AI Gateway request flow, provider/model routing, AI Proxy behavior, prompt/response controls, and LLM analytics. Use when the issue is inside AI Gateway, not generic prompt engineering, provider SDK debugging, or non-AI Gateway rollout. - [konnect-api-catalog](https://developer.konghq.com/skills/konnect-api-catalog.md): Diagnose and shape Konnect API Catalog APIs, versions, specs, implementations, and API packages before publication. Use when Catalog readiness is the question, not when the real owner is Dev Portal publication, app auth, or gateway delivery. - [konnect-api-publish](https://developer.konghq.com/skills/konnect-api-publish.md): Operate Konnect API publication from managed API through Catalog and Dev Portal. Use when an API should be visible but the missing link is Catalog readiness, portal publication, or audience scoping. Not for Catalog modeling or post-publication app auth. - [konnect-app-auth](https://developer.konghq.com/skills/konnect-app-auth.md): Use when Konnect Dev Portal APIs are published but blocked by application auth strategy, registration, approval, or app-credential flow issues; not for Portal sign-in/SSO or basic API publication. - [konnect-control-plane-bootstrap](https://developer.konghq.com/skills/konnect-control-plane-bootstrap.md): Bootstrap new Konnect Gateway control planes. Use for first-run topology, hosted versus self-hosted data planes, region/name/ownership choices, or moving from quickstart setup to durable management. Not for runtime triage or post-bootstrap Gateway config. - [konnect-event-gateway](https://developer.konghq.com/skills/konnect-event-gateway.md): Use when diagnosing Konnect Event Gateway request flow across listeners, hostname mapping, virtual/backend clusters, auth, and policy evaluation. Exclude generic gateway health, org access control, and declarative implementation after the failing hop is known. - [konnect-gateway-triage](https://developer.konghq.com/skills/konnect-gateway-triage.md): Use when triaging Konnect Gateway control-plane and data-plane failures such as disconnected planes, missing rollout, or wrong environment slices; separate attachment, network, live-state drift, and traffic-path failures before handing off fixes. - [konnect-monetization](https://developer.konghq.com/skills/konnect-monetization.md): Model and validate Konnect usage-based billing across meters, features, plans, rate cards, and invoices. Use when turning a pricing model into billing entities or checking allowance and overage math. Not for AI Gateway cost analytics or API Catalog packaging. - [konnect-observability-triage](https://developer.konghq.com/skills/konnect-observability-triage.md): Diagnose missing, partial, delayed, or mis-scoped Konnect observability data across analytics, Explorer, and Debugger. Use when the question is dataset, scope, or telemetry visibility, not pure gateway health or operator-access troubleshooting. - [konnect-platform-router](https://developer.konghq.com/skills/konnect-platform-router.md): Route broad or ambiguous Konnect requests to the first owning specialist skill. Use when multiple Konnect surfaces are involved or the right owner is unclear, not when the user already named a specific workflow, toolchain, or non-Konnect task. - [portal-branding](https://developer.konghq.com/skills/portal-branding.md): Replicate a brand or existing website's design on Kong Konnect Dev Portal pages. Use to match colors, fonts, imagery, and spacing through MDC components and page-level styling for visual parity. - [portal-page-design](https://developer.konghq.com/skills/portal-page-design.md): Structure and compose Kong Konnect Dev Portal pages with MDC components like heroes, cards, columns, tabbed panels, callouts, and expandable sections. Use for page layout, section design, and component choice. Not for documentation writing or editing. - [technical-writing](https://developer.konghq.com/skills/technical-writing.md): Write task-oriented developer documentation and Dev Portal page copy in plain, active-voice prose with clear, scannable structure. Use when authoring or editing technical docs, API guides, and page content. ## Konnect Reference Platform - [Konnect Reference Platform](https://developer.konghq.com/konnect-reference-platform.md): Provides a complete guide for platform builders to integrate Kong Konnect into their engineering organization and API delivery process. - [APIOps](https://developer.konghq.com/konnect-reference-platform/apiops.md): Provides details on how the Konnect Reference Platform uses APIOps - [Frequently asked questions](https://developer.konghq.com/konnect-reference-platform/faq.md): Provides a complete guide for platform builders to integrate Kong Konnect into their engineering organization and API delivery process. - [Kong Air](https://developer.konghq.com/konnect-reference-platform/kong-air.md): Provides example usage of the Konnect Reference Platform - [Konnect Orchestrator](https://developer.konghq.com/konnect-reference-platform/orchestrator.md): What is the Konnect Orchestrator and how is it used? ## Metering & Billing - [Metering & Billing](https://developer.konghq.com/metering-and-billing.md): Learn how to meter and bill for your features with Metering & Billing. - [Add-ons](https://developer.konghq.com/metering-and-billing/add-ons.md): Plan add-ons let you sell extra features, overage packs, or services without changing the core plan. - [Billing and invoicing](https://developer.konghq.com/metering-and-billing/billing-invoicing.md): Learn how billing and invoicing work in Konnect Metering & Billing. - [Collectors](https://developer.konghq.com/metering-and-billing/collectors.md): Learn about collectors in Konnect Metering & Billing and how to collect usage data from various sources. - [Kubernetes Collector](https://developer.konghq.com/metering-and-billing/collectors/kubernetes.md): Learn how to use the Kubernetes collector to meter pod resource usage in Konnect Metering & Billing. - [OpenTelemetry Collector](https://developer.konghq.com/metering-and-billing/collectors/opentelemetry.md): Learn how to use the OpenTelemetry collector to meter usage from logs in Konnect Metering & Billing. - [Prometheus Collector](https://developer.konghq.com/metering-and-billing/collectors/prometheus.md): Learn how to use the Prometheus collector to meter usage from Prometheus metrics in Konnect Metering & Billing. - [Run:ai Collector](https://developer.konghq.com/metering-and-billing/collectors/run-ai.md): Learn how to use the Nvidia Run:ai collector to meter GPU workloads in Konnect Metering & Billing. - [S3 Collector](https://developer.konghq.com/metering-and-billing/collectors/s3.md): Learn how to use the S3 collector to meter usage from S3-compatible object storage in Konnect Metering & Billing. - [Cost Analytics](https://developer.konghq.com/metering-and-billing/cost-analytics.md): Learn how to track and analyze feature usage costs with the LLM cost database and cost analytics in Konnect Metering & Billing. - [Prepaid credits](https://developer.konghq.com/metering-and-billing/credits.md): Understand how prepaid credits work in Konnect Metering & Billing: key concepts, terminology, and correctness guarantees. - [Credit balance model](https://developer.konghq.com/metering-and-billing/credits/balance-model.md): Understand the two credit balance types in Konnect Metering & Billing: settled and pending. - [Credit consumption and expiration](https://developer.konghq.com/metering-and-billing/credits/consumption-and-expiration.md): Learn how credits are consumed by charges and how unused credits expire in Konnect Metering & Billing. - [Correctness guarantees](https://developer.konghq.com/metering-and-billing/credits/correctness-guarantee.md): Konnect Metering & Billing keeps credit balances correct through a double-entry ledger, immutable movements, and deterministic consumption order. - [Feature filters](https://developer.konghq.com/metering-and-billing/credits/feature-filters.md): Restrict credit grants to specific product features and query balances or transaction history scoped to a single feature. - [Credit grants](https://developer.konghq.com/metering-and-billing/credits/grants.md): Learn how credit grants work in Konnect Metering & Billing: funding methods, priority, and expiration. - [Prepaid credit operational flows](https://developer.konghq.com/metering-and-billing/credits/operational-flows.md): Reference for common prepaid credit workflows in Konnect Metering & Billing. - [Credit transaction history](https://developer.konghq.com/metering-and-billing/credits/transaction-history.md): Understand credit movements, transaction history structure, ordering, and corrections in Konnect Metering & Billing. - [Collect payments with a custom invoicing integration](https://developer.konghq.com/metering-and-billing/custom-invoicing.md): Learn how to integrate external invoicing and payment providers with Metering & Billing using the Custom Invoicing app. - [Customers and usage attribution](https://developer.konghq.com/metering-and-billing/customer.md): Learn how Customers and usage attributes work in Konnect Metering & Billing and how they access features. - [Entitlements](https://developer.konghq.com/metering-and-billing/entitlements.md): Use entitlements to control customer access to features, enforce usage limits, and implement pricing strategies like prepaid billing and custom quotes. - [Events](https://developer.konghq.com/metering-and-billing/events.md): Learn how events work in Konnect Metering & Billing. - [Metering](https://developer.konghq.com/metering-and-billing/metering.md): Learn how metering works in Konnect Metering & Billing. - [Notifications](https://developer.konghq.com/metering-and-billing/notifications.md): Use Metering & Billing Notifications to receive webhook alerts when customers reach entitlement thresholds or billing events occur. - [How can Metering & Billing help?](https://developer.konghq.com/metering-and-billing/overview.md): Understand what Konnect Metering & Billing does and where it fits in your revenue infrastructure. - [Pricing models](https://developer.konghq.com/metering-and-billing/pricing-models.md): Reference for the pricing models available in Metering & Billing, including flat fee, usage-based, tiered, package, and dynamic pricing. - [Product Catalog](https://developer.konghq.com/metering-and-billing/product-catalog.md): Learn how the Product Catalog work in Konnect Metering & Billing and how they relate to usage tracking and external billing systems. - [Collect payments with Stripe](https://developer.konghq.com/metering-and-billing/stripe-integration.md): Learn how to collect revenue with Stripe Invoicing, Stripe Tax, and Stripe Payments with the Metering & Billing Stripe integration. - [Subscriptions](https://developer.konghq.com/metering-and-billing/subscriptions.md): Learn how subscriptions work in Konnect Metering & Billing and how to change, edit, cancel, and migrate them. - [Tax codes](https://developer.konghq.com/metering-and-billing/tax-codes.md): Learn how tax codes work in Konnect Metering & Billing, including tax behavior, organization defaults, and the fallback chain. ## Observability - [Custom Dashboards](https://developer.konghq.com/custom-dashboards.md): Build and manage dashboards for API analytics with reusable templates and automation support. - [Konnect Observability](https://developer.konghq.com/observability.md): Gain real-time insights into API health, performance, and usage with Konnect Observability. - [Custom Dashboards reference](https://developer.konghq.com/observability/custom-dashboards-reference.md): Custom Dashboards allow you to create dashboards for your specific use cases. - [Using Debugger for Datakit](https://developer.konghq.com/observability/datakit-debugger.md): Use Konnect Debugger to inspect Datakit node execution: trace node spans, view I/O values per node lifecycle event, and understand how sanitization rules apply to Datakit tracing data. - [Debugger spans](https://developer.konghq.com/observability/debugger-spans.md): Spans represent a single unit of trace in Kong Gateway this page contains all available spans. - [Troubleshooting with Konnect Debugger](https://developer.konghq.com/observability/debugger.md): The Debugger enables control plane administrators to initiate targeted deep session traces in specific data plane nodes and pin them, along with CPU profiles, for later analysis. ## Terraform - [terraform-kong-gateway](https://developer.konghq.com/skills/terraform-kong-gateway.md): Use when editing or reviewing Terraform that manages self-managed Kong Gateway Admin API entities with the official `kong/kong-gateway` provider; not for Konnect resources, decK-native Gateway GitOps, or gateway troubleshooting before tool choice. - [terraform-konnect](https://developer.konghq.com/skills/terraform-konnect.md): Use when a repo already manages Konnect in Terraform or the user explicitly wants HCL, Terraform import, or plan/apply for Konnect resources; not for `decK`/`kongctl` repos, generic Terraform-only troubleshooting, or domain-first Konnect diagnosis. - [Terraform providers for Kong](https://developer.konghq.com/terraform.md): This page is an introduction to the Terraform providers for Konnect, Kong Gateway and Kong Mesh. ## datakit - [gateway-plugin-datakit](https://developer.konghq.com/skills/gateway-plugin-datakit.md): Use when designing or debugging Kong DataKit plugin flows, including node selection, DAG wiring, jq transforms, cache or vault usage, and phase-specific request or response orchestration. Do not use for generic decK, Terraform, or Konnect workflow questions. ## deck - [decK](https://developer.konghq.com/deck.md): This page is an introduction to decK, a command line tool for API Lifecycle Automation. - [Interacting with AI Gateway entities](https://developer.konghq.com/deck/ai.md): Manage AI Gateway entities on-prem with decK. - [deck ai dump](https://developer.konghq.com/deck/ai/dump.md): Export the current state of AI Gateway to a file. - [deck ai sync](https://developer.konghq.com/deck/ai/sync.md): Update AI Gateway to match the state defined in the provided configuration. - [APIOps](https://developer.konghq.com/deck/apiops.md): Manage Kong Gateway declaratively - [Continuous integration with decK](https://developer.konghq.com/deck/apiops/continuous-integration.md): Run decK in CI/CD systems - [Federated configuration with decK](https://developer.konghq.com/deck/apiops/federated-configuration.md): Allow independent teams to manage their own configuration in a distributed way - [decK configuration](https://developer.konghq.com/deck/configuration.md): Configure decK using CLI flags, environment variables, or a configuration file - [Migrate from Kong Gateway DB-less format to decK state file format](https://developer.konghq.com/deck/dbless-vs-deck.md): Learn how the decK state file format and Kong's DB-less declarative format differ, including when to use each one, metadata fields, and entity representation differences. - [File manipulation using decK file](https://developer.konghq.com/deck/file.md): Manipulate a decK configuration file programmatically. Layer in additional configuration and lint against your governance rules. - [deck file ai2kong](https://developer.konghq.com/deck/file/ai2kong.md): Convert a state file that uses the AI Gateway 2.0 entity model to Kong Services and Routes. - [deck file convert](https://developer.konghq.com/deck/file/convert.md): Convert decK files from one format to another, for example Kong Gateway 2.x to 3.x - [deck file format](https://developer.konghq.com/deck/file/format.md): Convert decK files between decK and DB-less declarative formats. - [deck file kong2kic](https://developer.konghq.com/deck/file/kong2kic.md): Convert a Kong declarative configuration file to Kong Ingress Controller compatible CRDs. Supports both Gateway API and Ingress resources. - [deck file kong2tf](https://developer.konghq.com/deck/file/kong2tf.md): Convert a Kong declarative configuration file to Terraform manifests (Konnect only). - [deck file lint](https://developer.konghq.com/deck/file/lint.md): Validate your decK configuration file against predefined rules. - [Configuration transformation with decK](https://developer.konghq.com/deck/file/manipulation.md): Provides multiple commands to manipulate an existing declarative configuration file - [deck file namespace](https://developer.konghq.com/deck/file/manipulation/namespace.md): Apply a namespace to Routes in a decK file by path or hostname. - [deck file patch](https://developer.konghq.com/deck/file/manipulation/patch.md): Update values in a Kong declarative configuration file. - [Managing plugins with decK](https://developer.konghq.com/deck/file/manipulation/plugins.md): Manage plugin configurations in a Kong declarative configuration file. - [Manage tags with decK](https://developer.konghq.com/deck/file/manipulation/tags.md): Manage tags in a Kong declarative configuration file. - [deck file merge](https://developer.konghq.com/deck/file/merge.md): Merge multiple files in to a single file, leaving env variables in place. - [deck file openapi2kong](https://developer.konghq.com/deck/file/openapi2kong.md): Convert an OpenAPI specification to Kong Services and Routes. - [deck file openapi2mcp](https://developer.konghq.com/deck/file/openapi2mcp.md): Convert an OpenAPI specification to a Gateway Service with an MCP Route, an AI MCP Proxy plugin, and MCP tools. - [deck file render](https://developer.konghq.com/deck/file/render.md): Render the final configuration sent to the Admin API in a single file. - [deck file validate](https://developer.konghq.com/deck/file/validate.md): Validate your declarative configuration locally against predefined schemas - [deck gateway](https://developer.konghq.com/deck/gateway.md): Manage Kong Gateway declaratively - [deck gateway apply](https://developer.konghq.com/deck/gateway/apply.md): Apply configuration to Kong without deleting existing entities. - [Configuring on-prem authentication](https://developer.konghq.com/deck/gateway/configuration.md): Configure decK for use with an on-prem Kong Gateway - [De-duplicate plugin configuration](https://developer.konghq.com/deck/gateway/deduplicate.md): Reference predefined Plugin configurations in your declarative configuration. - [Object defaults](https://developer.konghq.com/deck/gateway/defaults.md): Set custom defaults for Kong Gateway entities. - [deck gateway diff](https://developer.konghq.com/deck/gateway/diff.md): Diff the current state of Kong Gateway against the provided configuration. - [deck gateway dump](https://developer.konghq.com/deck/gateway/dump.md): Export the current state of Kong Gateway to a file. - [Configuring Konnect](https://developer.konghq.com/deck/gateway/konnect-configuration.md): Configure decK for use with Konnect. - [deck gateway ping](https://developer.konghq.com/deck/gateway/ping.md): Verify that decK can talk to the configured Admin API. - [Manage RBAC roles](https://developer.konghq.com/deck/gateway/rbac.md): Configure your RBAC configuration declaratively with decK. - [deck gateway reset](https://developer.konghq.com/deck/gateway/reset.md): Delete all entities in Kong Gateway. - [Managing sensitive data](https://developer.konghq.com/deck/gateway/sensitive-data.md): Keep your secrets safe using Kong Gateway Vaults with decK. - [deck gateway sync](https://developer.konghq.com/deck/gateway/sync.md): Update Kong Gateway to match the state defined in the provided configuration. - [Select tags and lookup tags](https://developer.konghq.com/deck/gateway/tags.md): Segment your configuration in to multiple files using tags. - [deck gateway validate](https://developer.konghq.com/deck/gateway/validate.md): Validate the data in the provided state file against a live Admin API. - [Workspaces](https://developer.konghq.com/deck/gateway/workspaces.md): Manage configuration in multiple Workspaces. - [Upgrade to Kong Gateway 3.x with decK](https://developer.konghq.com/deck/reference/3.0-upgrade.md): Use decK to upgrade from Kong Gateway 2.x to 3.x - [Entities managed by decK](https://developer.konghq.com/deck/reference/entities.md): Understand which entities decK can manage - [Using environment variables in state files](https://developer.konghq.com/deck/reference/env-variables.md): Reference environment variables within your decK state files to pass per-environment configuration at runtime - [decK security](https://developer.konghq.com/deck/security.md): decK can be used to configure RBAC rules in Kong Gateway Enterprise - [decK version support policy](https://developer.konghq.com/deck/support.md): The decK version support policy outlines the decK versioning scheme and version lifecycle. - [deck-gateway](https://developer.konghq.com/skills/deck-gateway.md): Manage Kong Gateway entities with decK. Use for `deck gateway` state files, validate/diff/sync/dump workflows, OpenAPI-derived Gateway config, or GitOps-style Gateway entity repos. Do not use for Konnect platform resources or HCL/kongctl repos. ## kongctl - [kongctl](https://developer.konghq.com/kongctl.md): This page is an introduction to kongctl, Kong's command-line tool for managing Konnect resources and infrastructure as code. - [kongctl adopt](https://developer.konghq.com/kongctl/adopt.md): Adopt Kong resources using kongctl. - [kongctl adopt ai-gateway](https://developer.konghq.com/kongctl/adopt/ai-gateway.md): Apply the KONGCTL-namespace label to an existing Konnect AI Gateway that is not currently managed by kongctl. - [kongctl adopt analytics](https://developer.konghq.com/kongctl/adopt/analytics.md): The analytics command adopts Konnect Observability resources into namespace management. - [kongctl adopt api](https://developer.konghq.com/kongctl/adopt/api.md): Adopt API resources. - [kongctl adopt auth-strategy](https://developer.konghq.com/kongctl/adopt/auth-strategy.md): Adopt authentication strategies. - [kongctl adopt control-plane](https://developer.konghq.com/kongctl/adopt/control-plane.md): Adopt control plane configurations. - [kongctl adopt dcr-provider](https://developer.konghq.com/kongctl/adopt/dcr-provider.md): Apply the KONGCTL-namespace label to an existing Konnect DCR provider that is not currently managed by kongctl. - [kongctl adopt event-gateway](https://developer.konghq.com/kongctl/adopt/event-gateway.md): Apply the KONGCTL-namespace label to an existing Konnect Event Gateway Control Plane that is not currently managed by kongctl. - [kongctl adopt konnect](https://developer.konghq.com/kongctl/adopt/konnect.md): Adopt Konnect resources. - [kongctl adopt organization](https://developer.konghq.com/kongctl/adopt/organization.md): Adopt organization settings. - [kongctl adopt portal](https://developer.konghq.com/kongctl/adopt/portal.md): Adopt Dev Portal configuration. - [kongctl api](https://developer.konghq.com/kongctl/api.md): Make API requests using kongctl. - [kongctl api delete](https://developer.konghq.com/kongctl/api/delete.md): Delete resources via API. - [kongctl api get](https://developer.konghq.com/kongctl/api/get.md): Retrieve resources via API. - [kongctl api patch](https://developer.konghq.com/kongctl/api/patch.md): Partially update resources via API. - [kongctl api post](https://developer.konghq.com/kongctl/api/post.md): Create resources via API. - [kongctl api put](https://developer.konghq.com/kongctl/api/put.md): Update resources via API. - [kongctl apply](https://developer.konghq.com/kongctl/apply.md): Apply Konnect configuration using kongctl. - [kongctl apply konnect](https://developer.konghq.com/kongctl/apply/konnect.md): Apply configuration to Konnect control planes. - [Manage Konnect audit logs with kongctl](https://developer.konghq.com/kongctl/audit-logs.md): Pull, follow, and listen to Konnect audit logs with kongctl. - [Authentication with kongctl](https://developer.konghq.com/kongctl/authentication.md): Learn how to authenticate kongctl to Kong Konnect using the device flow or personal access tokens. - [APIOps for Konnect with kongctl and GitHub Actions](https://developer.konghq.com/kongctl/ci-cd/github-actions.md): Store Konnect declarative configuration in GitHub, show diffs on pull requests, and apply changes on pushes to main. - [Configuration of kongctl](https://developer.konghq.com/kongctl/config.md): Learn how to configure kongctl using configuration files, environment variables, and command-line flags. - [kongctl create](https://developer.konghq.com/kongctl/create.md): Create Konnect access tokens using kongctl. - [kongctl create konnect](https://developer.konghq.com/kongctl/create/konnect.md): Create Konnect access tokens - [kongctl create organization](https://developer.konghq.com/kongctl/create/organization.md): Manage Konnect system accounts. - [kongctl create pat](https://developer.konghq.com/kongctl/create/pat.md): Create a Konnect personal access token. - [kongctl create spat](https://developer.konghq.com/kongctl/create/spat.md): Create a Konnect system account access token. - [Declarative configuration with kongctl](https://developer.konghq.com/kongctl/declarative.md): Learn how to manage Kong Konnect infrastructure as code using declarative YAML configuration. - [kongctl delete](https://developer.konghq.com/kongctl/delete.md): Delete resources using kongctl. - [kongctl delete konnect](https://developer.konghq.com/kongctl/delete/konnect.md): Delete Konnect tokens. - [kongctl delete organization](https://developer.konghq.com/kongctl/delete/organization.md): Manage Konnect system account resources. - [kongctl delete pat](https://developer.konghq.com/kongctl/delete/pat.md): Delete a Konnect personal access token. - [kongctl delete spat](https://developer.konghq.com/kongctl/delete/spat.md): Delete a Konnect system account access token. - [kongctl diff](https://developer.konghq.com/kongctl/diff.md): Compare configurations using kongctl. - [kongctl diff konnect](https://developer.konghq.com/kongctl/diff/konnect.md): Show Konnect configuration differences. - [Run kongctl in Docker](https://developer.konghq.com/kongctl/docker.md): Run kongctl in a Docker container to authenticate to Konnect, query resources, and apply local declarative configuration files. - [kongctl dump](https://developer.konghq.com/kongctl/dump.md): Export configurations using kongctl. - [kongctl dump declarative](https://developer.konghq.com/kongctl/dump/declarative.md): Export declarative configuration. - [kongctl dump tf-import](https://developer.konghq.com/kongctl/dump/tf-import.md): Export configurations into Terraform format. - [kongctl explain](https://developer.konghq.com/kongctl/explain.md): Explain shows the declarative schema for a supported resource type or field path. - [kongctl get](https://developer.konghq.com/kongctl/get.md): Get detailed information about resources using kongctl. - [kongctl get ai-gateway](https://developer.konghq.com/kongctl/get/ai-gateway.md): Use the get verb with the ai-gateway command to query Konnect AI Gateways. - [kongctl get analytics](https://developer.konghq.com/kongctl/get/analytics.md): The analytics command allows you to work with Konnect Observability resources. - [kongctl get api](https://developer.konghq.com/kongctl/get/api.md): Get API details. - [kongctl get audit-logs](https://developer.konghq.com/kongctl/get/audit-logs.md): Pull organization audit logs and inspect audit-log configuration. - [kongctl get auth-strategy](https://developer.konghq.com/kongctl/get/auth-strategy.md): Get authentication strategy details. - [kongctl get catalog](https://developer.konghq.com/kongctl/get/catalog.md): Get API catalog details. - [kongctl get dcr-provider](https://developer.konghq.com/kongctl/get/dcr-provider.md): Use the get verb with the dcr-provider command to query Konnect Dynamic Client Registration providers. - [kongctl get event-gateway](https://developer.konghq.com/kongctl/get/event-gateway.md): Use the get verb with the event-gateway command to query Konnect Event Gateways. - [kongctl get extension](https://developer.konghq.com/kongctl/get/extension.md): Get a kongctl CLI extension. - [kongctl get gateway](https://developer.konghq.com/kongctl/get/gateway.md): Get gateway information. - [kongctl get konnect](https://developer.konghq.com/kongctl/get/konnect.md): Get Konnect account information. - [kongctl get me](https://developer.konghq.com/kongctl/get/me.md): Get current user information. - [kongctl get organization](https://developer.konghq.com/kongctl/get/organization.md): Get organization details. - [kongctl get pat](https://developer.konghq.com/kongctl/get/pat.md): Get Konnect personal access tokens. - [kongctl get portal](https://developer.konghq.com/kongctl/get/portal.md): Get Portal configuration. - [kongctl get profile](https://developer.konghq.com/kongctl/get/profile.md): Get user profiles. - [kongctl get regions](https://developer.konghq.com/kongctl/get/regions.md): Get available regions. - [kongctl get spat](https://developer.konghq.com/kongctl/get/spat.md): Get Konnect system account access tokens. - [kongctl install](https://developer.konghq.com/kongctl/install.md): Install local assets that help coding agents work with Konnect using kongctl. - [kongctl install extension](https://developer.konghq.com/kongctl/install/extension.md): Install a kongctl CLI extension. - [kongctl install skills](https://developer.konghq.com/kongctl/install/skills.md): Install kongctl agent skills. - [kongctl and decK](https://developer.konghq.com/kongctl/kongctl-and-deck.md): Learn how to use kongctl and decK together for declarative management of the entire API platform - [kongctl link](https://developer.konghq.com/kongctl/link.md): Link locally developed features using kongctl. - [kongctl link extension](https://developer.konghq.com/kongctl/link/extension.md): Link a local development CLI extension. - [kongctl lint](https://developer.konghq.com/kongctl/lint.md): Validate configuration files against a linting ruleset. - [kongctl list](https://developer.konghq.com/kongctl/list.md): List resources using kongctl. - [kongctl list ai-gateway](https://developer.konghq.com/kongctl/list/ai-gateway.md): Use the list verb with the ai-gateway command to list Konnect AI Gateways. - [kongctl list api](https://developer.konghq.com/kongctl/list/api.md): List APIs. - [kongctl list auth-strategy](https://developer.konghq.com/kongctl/list/auth-strategy.md): List authentication strategies. - [kongctl list dcr-provider](https://developer.konghq.com/kongctl/list/dcr-provider.md): Use the list verb with the dcr-provider command to query Konnect Dynamic Client Registration providers. - [kongctl list extensions](https://developer.konghq.com/kongctl/list/extensions.md): List installed kongctl CLI extensions. - [kongctl list gateway](https://developer.konghq.com/kongctl/list/gateway.md): List gateways. - [kongctl list konnect](https://developer.konghq.com/kongctl/list/konnect.md): List Konnect resources. - [kongctl list organization](https://developer.konghq.com/kongctl/list/organization.md): List organizations. - [kongctl list portal](https://developer.konghq.com/kongctl/list/portal.md): List Portal configurations. - [kongctl list profile](https://developer.konghq.com/kongctl/list/profile.md): The profile command allows you to list kongctl profiles and inspect profile configuration. - [kongctl list themes](https://developer.konghq.com/kongctl/list/themes.md): List Portal themes. - [kongctl listen](https://developer.konghq.com/kongctl/listen.md): Listen to events using kongctl. - [kongctl listen audit-logs](https://developer.konghq.com/kongctl/listen/audit-logs.md): Listen to audit log stream. - [kongctl listen konnect](https://developer.konghq.com/kongctl/listen/konnect.md): Listen to Konnect events. - [kongctl login](https://developer.konghq.com/kongctl/login.md): Authenticate with kongctl. - [kongctl login konnect](https://developer.konghq.com/kongctl/login/konnect.md): Log in to Konnect. - [kongctl logout](https://developer.konghq.com/kongctl/logout.md): Log out with kongctl. - [kongctl logout konnect](https://developer.konghq.com/kongctl/logout/konnect.md): Log out from Konnect. - [kongctl patch](https://developer.konghq.com/kongctl/patch.md): Patch resources using kongctl. - [kongctl patch file](https://developer.konghq.com/kongctl/patch/file.md): Apply patches from a declarative config file. - [kongctl plan](https://developer.konghq.com/kongctl/plan.md): Plan changes using kongctl. - [kongctl plan konnect](https://developer.konghq.com/kongctl/plan/konnect.md): Plan changes for Konnect. - [kongctl ps](https://developer.konghq.com/kongctl/ps.md): Manage processes using kongctl. - [kongctl ps stop](https://developer.konghq.com/kongctl/ps/stop.md): Stop Kong processes. - [kongctl roar](https://developer.konghq.com/kongctl/roar.md): Feel the Kong power! - [kongctl scaffold](https://developer.konghq.com/kongctl/scaffold.md): Scaffold emits a commented YAML starter configuration for a supported declarative resource path. - [Use kongctl with AI agent skills](https://developer.konghq.com/kongctl/skills.md): Install kongctl agent skills to help coding agents manage kongctl configuration. - [kongctl declarative resource reference](https://developer.konghq.com/kongctl/supported-resources.md): Reference for kongctl declarative configuration that lists supported resource types and their field-level values. - [kongctl sync](https://developer.konghq.com/kongctl/sync.md): Synchronize configurations using kongctl. - [kongctl sync konnect](https://developer.konghq.com/kongctl/sync/konnect.md): Sync configuration with Konnect control planes. - [kongctl tail](https://developer.konghq.com/kongctl/tail.md): Tail logs using kongctl. - [kongctl tail audit-logs](https://developer.konghq.com/kongctl/tail/audit-logs.md): Follow organization audit logs. - [kongctl tail konnect](https://developer.konghq.com/kongctl/tail/konnect.md): Tail Konnect events. - [Troubleshooting kongctl](https://developer.konghq.com/kongctl/troubleshooting.md): Common issues and solutions when using kongctl. - [kongctl uninstall](https://developer.konghq.com/kongctl/uninstall.md): Uninstall kongctl features. - [kongctl uninstall extension](https://developer.konghq.com/kongctl/uninstall/extension.md): Uninstall a kongctl CLI extension. - [kongctl upgrade](https://developer.konghq.com/kongctl/upgrade.md): Upgrade kongctl features. - [kongctl upgrade extension](https://developer.konghq.com/kongctl/upgrade/extension.md): Upgrade kongctl CLI extensions. - [kongctl view](https://developer.konghq.com/kongctl/view.md): Launch the Konnect interactive viewer. - [kongctl-declarative](https://developer.konghq.com/skills/kongctl-declarative.md): Use for `kongctl`-managed Konnect declarative repos: author YAML, model APIs from OpenAPI, and run plan/diff/apply/sync/delete/adopt workflows or CI/CD. Do not use for read-only inspection, exact `get` syntax, or non-`kongctl` toolchains. - [kongctl-query](https://developer.konghq.com/skills/kongctl-query.md): Use when the user wants read-only `kongctl` queries against Konnect: prove auth or scope, discover the right `get` path, list or fetch resources, or shape JSON/YAML output. Do not use for `kongctl` plan/apply/sync or declarative authoring. ## repo - [kong-skill-authoring](https://developer.konghq.com/skills/kong-skill-authoring.md): Create or refactor a skill in this repo. Use when deciding extend-versus-create, classifying domain/tool/router ownership, tightening a description, or reviewing a skill package against repo policy. Not for the product workflow itself. ## Other - [API Reference](https://developer.konghq.com/api.md): Directory of OpenAPI specifications for various Kong APIs. - [Release notes](https://developer.konghq.com/changelogs.md): Release notes and changelogs for all Kong products. - [Kong AI Gateway Cookbooks](https://developer.konghq.com/cookbooks.md): A collection of production-ready recipes to build with Kong AI Gateway. LLM routing, guardrails, semantic caching, cost optimization, governance, and MCP integration. - [Glossary](https://developer.konghq.com/glossary.md): Common terms used across Kong. - [How-to Guides](https://developer.konghq.com/how-to.md): Discover Kong's tutorials to help you build, secure, and scale your services. - [Kong Plugin Hub](https://developer.konghq.com/plugins.md): Extend Kong Gateway and Kong Konnect with powerful plugins and easy integrations. - [Rate limiting](https://developer.konghq.com/rate-limiting.md): This page is an introduction to rate limiting with Kong. - [Kong Skills Hub](https://developer.konghq.com/skills.md): Browse and search Kong skills for AI-powered development workflows - [Install Kong Skills](https://developer.konghq.com/skills/install.md): Step-by-step installation instructions for Kong skills across supported AI coding tools including Claude Code, Cursor, AWS, and more. - [Stages of software availability](https://developer.konghq.com/stages-of-software-availability.md): This document describes the different stages of software availability for Kong products. - [Support Articles](https://developer.konghq.com/support.md): Browse troubleshooting guides and knowledge base articles for Kong products and services. - [Tools for managing Konnect and Kong Gateway](https://developer.konghq.com/tools.md): An introduction to the common tools for managing Kong Gateway and Konnect. ## Cookbooks - [Basic LLM Routing](https://developer.konghq.com/cookbooks/basic-llm-routing.md): Route requests to any supported LLM provider through Kong AI Gateway with Consumer authentication and per-request model selection. - [Claude Code SSO](https://developer.konghq.com/cookbooks/claude-code-sso.md): Authenticate Claude Code requests via Okta SSO with consumer-group-based model routing and per-tier rate limiting. - [GitHub Copilot BYOK Custom Endpoint](https://developer.konghq.com/cookbooks/github-copilot-byok.md): Route GitHub Copilot Chat and agent traffic through Kong Gateway via Copilot's Bring Your Own Key Custom Endpoint, with per-Consumer attribution, request normalization, and token rate limiting. - [LLM Cost Optimization](https://developer.konghq.com/cookbooks/llm-cost-optimization.md): Reduce LLM infrastructure costs using semantic routing, caching, prompt compression, and tiered cost-based rate limiting. - [Mistral AI with Kong AI Gateway](https://developer.konghq.com/cookbooks/mistral-ai-with-kong-ai-gateway.md): Put Mistral chat and embedding models behind one Kong AI Gateway endpoint, with per-application API keys, so no client ever holds your Mistral key. - [Model-Based Routing](https://developer.konghq.com/cookbooks/model-based-routing.md): Dynamically route requests across OpenAI and AWS Bedrock based on prompt complexity analysis. - [Secure External MCP Gateway](https://developer.konghq.com/cookbooks/secure-external-mcp-gateway.md): Proxy third-party MCP servers (GitHub, Konnect) through Kong Gateway with centralized access control, observability, and tool-level ACLs. - [Secure Internal MCP Gateway](https://developer.konghq.com/cookbooks/secure-internal-mcp-gateway.md): Aggregate multiple internal APIs into a single MCP server with OAuth 2.1 authentication and tool-level access control via consumer-group ACLs. - [Voice AI Pipeline Observability](https://developer.konghq.com/cookbooks/voice-ai-observability.md): Observe and govern a cascading voice AI pipeline (STT, LLM, TTS) with per-hop telemetry and conversation-level tracing through Langfuse. ## How-To Guides - [Aggregate MCP tools from multiple AI MCP Server entities](https://developer.konghq.com/ai-gateway/aggregate-mcp-tools.md): Aggregate MCP tools from multiple RESTful APIs into a single MCP endpoint using AI MCP Server entities in conversion-only and listener modes - [Enforce tiered AI budgets on AI Models with Kong Identity](https://developer.konghq.com/ai-gateway/enforce-tiered-ai-budgets-with-kong-identity.md): Attach an AI Auth Strategy backed by Kong Identity, per-model ACLs across a standard and a premium AI Model, and a multi-ceiling AI Rate Limiting Advanced Policy to enforce tiered AI budgets from a claim. - [Route A2A agent traffic through AI Gateway](https://developer.konghq.com/ai-gateway/get-started-with-ai-agent.md): Create an AI Agent entity in AI Gateway to proxy Agent-to-Agent (A2A) protocol traffic - [Map the WeatherAPI to an MCP Server](https://developer.konghq.com/ai-gateway/get-started-with-mcp-server.md): Learn how to create an MCP Server entity in AI Gateway to expose WeatherAPI operations as MCP tools - [Get started with AI Gateway](https://developer.konghq.com/ai-gateway/get-started.md): Learn how to proxy LLM traffic with AI Gateway entities in Kong Konnect - [Use the AI AWS Guardrails Policy](https://developer.konghq.com/ai-gateway/how-to/use-ai-aws-guardrails-policy.md): Learn how to use the AI AWS Guardrails Policy. - [Identify AI Consumers on AI Model traffic with Kong Identity](https://developer.konghq.com/ai-gateway/identify-ai-consumers-with-kong-identity.md): Replace a placeholder API key with a real oauth AI Consumer backed by Kong Identity, so AI Model traffic is authenticated and usage is tracked per consumer - [Limit A2A request body size](https://developer.konghq.com/ai-gateway/limit-a2a-body-size.md): Attach a Request Size Limiting AI Policy to an AI Agent entity to reject oversized A2A requests - [Map a RESTful API to MCP tools](https://developer.konghq.com/ai-gateway/map-api-to-mcp-tools.md): Learn how to create an MCP Server entity in AI Gateway to convert any RESTful API into MCP tools. - [Monetize AI Gateway traffic](https://developer.konghq.com/ai-gateway/meter-llm-traffic.md): Learn how to meter LLM traffic from AI Gateway using Konnect Metering & Billing. - [Monitor AI Agent traffic with OpenTelemetry](https://developer.konghq.com/ai-gateway/monitor-ai-agent-with-opentelemetry.md): Attach an OpenTelemetry AI Policy to an AI Agent entity to export A2A traces and metrics to an OTLP collector - [Monitor MCP traffic with OpenTelemetry](https://developer.konghq.com/ai-gateway/monitor-mcp-traffic-with-otel.md): Attach an OpenTelemetry Policy to an MCP Server entity to export OTLP metrics for MCP tool traffic to a collector. - [Observe MCP traffic with the File Log Policy](https://developer.konghq.com/ai-gateway/observe-mcp-traffic.md): Learn how to observe MCP tool activity after you apply access controls. Attach a File Log Policy to an AI MCP Server, generate traffic with the MCP Inspector CLI, then read the audit entries to see which tools each AI Consumer reached and how the ACLs decided each call. - [Use AI PII Sanitizer plugin to protect sensitive data in responses](https://developer.konghq.com/ai-gateway/protect-sensitive-information-output-with-ai.md): Use the AI PII Sanitizer plugin to protect sensitive information in responses. - [Use AI PII Sanitizer to protect sensitive data in requests](https://developer.konghq.com/ai-gateway/protect-sensitive-information-with-ai.md): Use the AI Sanitizer plugin to protect sensitive information in requests. - [Rate limit A2A traffic](https://developer.konghq.com/ai-gateway/rate-limit-a2a-traffic.md): Apply rate limits to A2A routes proxied through AI Gateway - [Secure AI Agent traffic with an AI Auth Strategy and Kong Identity](https://developer.konghq.com/ai-gateway/secure-ai-agent-with-oidc.md): Reference an openid-connect AI Auth Strategy backed by Kong Identity on an AI Agent entity to require bearer tokens on A2A traffic - [Set up a Kong Identity auth server for AI Agent authentication](https://developer.konghq.com/ai-gateway/set-up-kong-identity-for-a2a.md): Create a Kong Identity auth server, scope, claim, and client to issue bearer tokens for authenticating AI Agent A2A traffic. - [Set up a Kong Identity auth server for tiered AI budgets](https://developer.konghq.com/ai-gateway/set-up-kong-identity-for-tiered-ai-budgets.md): Create a Kong Identity auth server with dynamic claims and per-client labels to drive tiered AI budget enforcement. - [Control MCP tool access with AI Consumer and AI Consumer Group ACLs](https://developer.konghq.com/ai-gateway/use-access-controls-for-mcp-tools.md): Learn how to create an AI MCP Server entity in AI Gateway to restrict access to specific MCP tools based on AI Consumers and AI Consumer Groups. Configure default and per-tool ACLs, define user roles, and validate access behavior with the MCP Inspector CLI. - [Use AI Prompt Guard Policy to govern your LLM traffic](https://developer.konghq.com/ai-gateway/use-ai-prompt-guard-policy.md): Use the AI Prompt Guard Policy to filter LLM traffic based on regex rules that allow general IT questions and deny unsafe or off-topic content. - [Route Claude CLI traffic through AI Gateway and Anthropic](https://developer.konghq.com/ai-gateway/use-claude-code-with-ai-gateway-anthropic.md): Configure AI Gateway to proxy Claude CLI traffic - [Route Claude CLI traffic through AI Gateway and Azure](https://developer.konghq.com/ai-gateway/use-claude-code-with-ai-gateway-azure.md): Configure AI Gateway to proxy Claude CLI traffic to a Claude model hosted on Azure AI Foundry - [Route Claude CLI traffic through AI Gateway and AWS Bedrock](https://developer.konghq.com/ai-gateway/use-claude-code-with-ai-gateway-bedrock.md): Configure AI Gateway to proxy Claude CLI traffic to an AWS Bedrock model - [Route Claude CLI traffic through AI Gateway and DashScope](https://developer.konghq.com/ai-gateway/use-claude-code-with-ai-gateway-dashscope.md): Configure AI Gateway to proxy Claude CLI traffic to an Alibaba Cloud DashScope model. - [Route Claude CLI traffic through AI Gateway and Gemini](https://developer.konghq.com/ai-gateway/use-claude-code-with-ai-gateway-gemini.md): Configure AI Gateway to proxy Claude CLI traffic to a Gemini model - [Route Claude CLI traffic through AI Gateway and Hugging Face](https://developer.konghq.com/ai-gateway/use-claude-code-with-ai-gateway-huggingface.md): Configure AI Gateway to proxy Claude CLI traffic to a Hugging Face model - [Route Claude CLI traffic through AI Gateway and OpenAI](https://developer.konghq.com/ai-gateway/use-claude-code-with-ai-gateway-openai.md): Configure AI Gateway to proxy Claude CLI traffic to an OpenAI model - [Route OpenAI Codex CLI traffic through AI Gateway](https://developer.konghq.com/ai-gateway/use-codex-with-ai-gateway.md): Configure AI Gateway to proxy OpenAI Codex CLI traffic through the OpenAI Responses API. - [Route Google Gemini CLI traffic through AI Gateway](https://developer.konghq.com/ai-gateway/use-gemini-cli-with-ai-gateway.md): Configure AI Gateway to proxy Google Gemini CLI traffic to a Gemini model - [Route Qwen Code CLI traffic through AI Gateway and OpenAI](https://developer.konghq.com/ai-gateway/use-qwen-code-with-ai-gateway-openai.md): Configure AI Gateway to proxy Qwen Code CLI traffic to an OpenAI model - [Route Qwen Code CLI traffic through AI Gateway and DashScope](https://developer.konghq.com/ai-gateway/use-qwen-code-with-ai-gateway-qwen.md): Configure AI Gateway to proxy Qwen Code CLI traffic to an Alibaba Cloud DashScope model - [Deploy an MCP server with Context Mesh and Kong Operator](https://developer.konghq.com/context-mesh/get-started.md): Deploy a Context Mesh-backed MCP server with the Konnect API onto an Operator-managed data plane - [Add metrics to a custom plugin](https://developer.konghq.com/custom-plugins/get-started/add-metrics.md): Register and record custom metrics from your custom plugin using the Metrics PDK. - [Add a custom plugin configuration](https://developer.konghq.com/custom-plugins/get-started/add-plugin-configuration.md): Add features to your custom plugin. - [Add custom plugin testing](https://developer.konghq.com/custom-plugins/get-started/add-plugin-testing.md): Set up a testing environment for your custom plugin. - [Consume external services in a custom plugin](https://developer.konghq.com/custom-plugins/get-started/consume-external-services.md): Consume data from external services in your custom plugin using an HTTP client and parsing JSON values. - [Deploy a custom plugin with Docker](https://developer.konghq.com/custom-plugins/get-started/deploy-plugins.md): Deploy your custom plugin to Kong Gateway. - [Set up a custom plugin project](https://developer.konghq.com/custom-plugins/get-started/set-up-plugin-project.md): Create a simple custom plugin project for Kong Gateway. - [Get started with decK](https://developer.konghq.com/deck/get-started.md): Learn how to install decK and use it to configure Kong Gateway - [Configure an AWS managed cache for a Dedicated Cloud Gateway control plane group](https://developer.konghq.com/dedicated-cloud-gateways/aws-managed-cache-control-plane-group.md): Learn how to configure an AWS managed cache for a Dedicated Cloud Gateway control plane group. - [Configure an AWS managed cache for a Dedicated Cloud Gateway control plane](https://developer.konghq.com/dedicated-cloud-gateways/aws-managed-cache-control-plane.md): Learn how to configure an AWS managed cache for a Dedicated Cloud Gateway control plane. - [Set up an AWS resource endpoint connection](https://developer.konghq.com/dedicated-cloud-gateways/aws-resource-endpoints.md): Learn how to configure AWS resource endpoints for Dedicated Cloud Gateway. - [Set up an AWS VPC peering connection](https://developer.konghq.com/dedicated-cloud-gateways/aws-vpc-peering.md): Use the Konnect Cloud Gateways API to create a VPC peering connection with your AWS VPC. - [Configure an Azure managed cache for a Dedicated Cloud Gateway control plane group](https://developer.konghq.com/dedicated-cloud-gateways/azure-managed-cache-control-plane-group.md): Learn how to configure an Azure managed cache for a Dedicated Cloud Gateway control plane group. - [Configure an Azure managed cache for a Dedicated Cloud Gateway control plane](https://developer.konghq.com/dedicated-cloud-gateways/azure-managed-cache-control-plane.md): Learn how to configure an Azure managed cache for a Dedicated Cloud Gateway control plane. - [Configure an Azure Dedicated Cloud Gateway with VNET peering](https://developer.konghq.com/dedicated-cloud-gateways/azure-peering.md): Learn how to configure an Azure Dedicated Cloud Gateway with VNET peering. - [Configure an Azure Dedicated Cloud Gateway with virtual hub peering and outbound DNS resolution](https://developer.konghq.com/dedicated-cloud-gateways/azure-virtual-wan-with-outbound-dns-resolver.md): Learn how to configure an Azure Dedicated Cloud Gateway with virtual hub peering and outbound DNS resolution. - [Configure an Azure Dedicated Cloud Gateway with virtual hub peering and private DNS](https://developer.konghq.com/dedicated-cloud-gateways/azure-virtual-wan-with-private-dns.md): Learn how to configure an Azure Dedicated Cloud Gateway with virtual hub peering and private DNS. - [Configure an Azure Dedicated Cloud Gateway with virtual WAN](https://developer.konghq.com/dedicated-cloud-gateways/azure-virtual-wan.md): Learn how to configure an Azure Dedicated Cloud Gateway with virtual WAN. - [Configure an Azure Dedicated Cloud Gateway with VNET peering and outbound DNS resolution](https://developer.konghq.com/dedicated-cloud-gateways/azure-vnet-peering-with-outbound-dns-resolver.md): Learn how to configure an Azure Dedicated Cloud Gateway with VNET peering and outbound DNS resolution. - [Configure an Azure Dedicated Cloud Gateway with VNET peering and private hosted zones](https://developer.konghq.com/dedicated-cloud-gateways/azure-vnet-peering-with-private-hosted-zones.md): Learn how to configure an Azure Dedicated Cloud Gateway with VNET peering and private hosted zones. - [Flush a public Dedicated Cloud Gateway managed cache using Terraform](https://developer.konghq.com/dedicated-cloud-gateways/flush-managed-cache.md): Use Terraform to deploy a custom plugin that flushes a public Dedicated Cloud Gateway AWS managed cache on demand. - [Set up a GCP private DNS for Dedicated Cloud Gateway](https://developer.konghq.com/dedicated-cloud-gateways/gcp-private-dns.md): Use the Konnect Cloud Gateways API or the Konnect UI to create a private DNS with your GCP DNS zone. - [Set up a GCP VPC peering connection](https://developer.konghq.com/dedicated-cloud-gateways/gcp-vpc-peering.md): Use the Konnect Cloud Gateways API or the Konnect UI to create a VPC peering connection with your GCP VPC. - [Configure an AWS outbound DNS resolver for Dedicated Cloud Gateway](https://developer.konghq.com/dedicated-cloud-gateways/outbound-dns-resolver.md): Forward DNS queries from your Dedicated Cloud Gateway to custom DNS servers using an outbound resolver. - [Configure AWS private hosted zones for Dedicated Cloud Gateway](https://developer.konghq.com/dedicated-cloud-gateways/private-hosted-zones.md): Enable private DNS resolution for your Dedicated Cloud Gateway using either a private hosted zone or an Outbound DNS Resolver. - [Add the EqualWeb accessibility widget to Dev Portal](https://developer.konghq.com/dev-portal/equalweb.md): Learn how to add the EqualWeb accessibility widget to all pages of your Konnect Dev Portal. - [Send Dev Portal events data to Google Analytics](https://developer.konghq.com/dev-portal/google-analytics.md): Learn how to configure Google Analytics 4 to track events on your Konnect Dev Portal. - [Add the Google Tag Manager script to Dev Portal](https://developer.konghq.com/dev-portal/google-tag-manager.md): Learn how to add the Google Tag Manager script to all pages of your Konnect Dev Portal. - [Authenticate Kong Event Gateway connections to Kafka using mTLS](https://developer.konghq.com/event-gateway/configure-mtls-backend-cluster-auth.md): Configure mTLS authentication so that Kong Event Gateway can connect to a secured Kafka cluster. - [Configure mTLS client authentication with Kong Event Gateway](https://developer.konghq.com/event-gateway/configure-mtls-client-authentication.md): Require Kafka clients to present a trusted certificate when connecting to Kong Event Gateway using mutual TLS (mTLS), and use principals derived from the client certificate to enforce access control. - [Set up observability for Kong Event Gateway](https://developer.konghq.com/event-gateway/configure-observability-with-otel.md): Export metrics, traces, and logs from Kong Event Gateway into your own observability systems using OpenTelemetry (OTEL). - [Authenticate Kong Event Gateway connections to Kafka using SASL/PLAIN](https://developer.konghq.com/event-gateway/configure-sasl-plain-backend-cluster-auth.md): Configure SASL/PLAIN authentication so that Kong Event Gateway can connect to a secured Kafka cluster. - [Configure SNI routing with Kong Event Gateway](https://developer.konghq.com/event-gateway/configure-sni-routing.md): Set up SNI routing to send traffic to multiple virtual clusters in the same Event Gateway control plane without opening more ports on the data plane. - [Configure topic aliases with Kong Event Gateway](https://developer.konghq.com/event-gateway/configure-topic-aliases.md): Use topic aliases to expose backend Kafka topics under user-friendly names. - [Encrypt and decrypt Kafka fields dynamically in message values with Kong Event Gateway](https://developer.konghq.com/event-gateway/encrypt-kafka-message-fields-dynamic.md): Use this tutorial to dynamically generate a list of fields to encrypt and decrypt with Kong Event Gateway. - [Encrypt and decrypt Kafka fields in message values with Kong Event Gateway](https://developer.konghq.com/event-gateway/encrypt-kafka-message-fields-with-event-gateway.md): Use this tutorial to encrypt and decrypt Kafka fields in Kafka message values with Kong Event Gateway using a static key. - [Encrypt and decrypt Kafka messages with Kong Event Gateway](https://developer.konghq.com/event-gateway/encrypt-kafka-messages-with-event-gateway.md): Use this tutorial to encrypt and decrypt Kafka messages with Kong Event Gateway using a static key. - [Filter Kafka records by classification headers](https://developer.konghq.com/event-gateway/filter-records-by-classification.md): Classify records at produce time and filter them at consume time based on user identity. - [Get started with Kong Event Gateway](https://developer.konghq.com/event-gateway/get-started.md): Use this tutorial to get started with Kong Event Gateway. - [Enrich Kafka OAuth connections with Kong Identity principal metadata](https://developer.konghq.com/event-gateway/kong-identity-jwt-metadata-integration.md): Look up Kong Identity principal metadata from a JWT-authenticated Kafka connection and use it to drive Kong Event Gateway policies. - [Enrich Kafka SASL PLAIN connections with Kong Identity principal metadata](https://developer.konghq.com/event-gateway/kong-identity-metadata-integration.md): Look up Kong Identity principal metadata from a SASL-authenticated Kafka connection and use it to drive Kong Event Gateway policies. - [Set up Kong Event Gateway with Kong Identity OAuth](https://developer.konghq.com/event-gateway/kong-identity-oauth.md): Learn how to secure Kafka traffic in Event Gateway with Kong Identity. - [Productize Kafka topics with Kong Event Gateway](https://developer.konghq.com/event-gateway/productize-kafka-topics.md): Use namespaces and ACL policies to create products from Kafka topics. - [Validate Avro messages with Confluent Schema Registry](https://developer.konghq.com/event-gateway/validate-avro-messages-with-schema-registry.md): Enforce Avro schema validation on produced messages using the Confluent Schema Registry and Kong Event Gateway. - [Verify Kong Event Gateway image signatures and attestations](https://developer.konghq.com/event-gateway/verify-image-signatures-and-attestations.md): Use Cosign to verify the signature of the Kong Event Gateway container image and to inspect the attestations attached to it, including the SBOM and vulnerability scans. - [Configure conditional plugin execution in Kong Gateway](https://developer.konghq.com/gateway/configure-conditional-plugin-execution.md): Learn how to control when a Kong Gateway plugin executes based on request attributes. - [Configure dynamic plugin config with CEL in Kong Gateway](https://developer.konghq.com/gateway/configure-dynamic-plugin-config-with-cel.md): Learn how to set a Rate Limiting Advanced plugin's rate limit and rate limiting key per request, based on the authenticated Principal's metadata. - [Get started with Kong Gateway](https://developer.konghq.com/gateway/get-started.md): Learn how to set up a local Kong Gateway installation and configure it for some common API management tasks. - [Install Kong Gateway using the distroless image](https://developer.konghq.com/gateway/install/docker-distroless.md): Run Kong Gateway from the distroless Docker image, which contains only the Kong Gateway runtime and its dependencies with no shell or package manager. - [Install Kong Gateway in read-only mode using Docker Compose](https://developer.konghq.com/gateway/install/docker-read-only.md): Use Docker Compose to install Kong Gateway in read-only mode - [Install Kong Gateway using Docker Compose](https://developer.konghq.com/gateway/install/docker.md): Use Docker Compose to install Kong Gateway - [Run Kong Gateway in Hybrid mode](https://developer.konghq.com/gateway/install/hybrid.md): Configure separate Control Plane and Data Plane nodes using Hybrid mode and mTLS - [Install Kong Gateway in Konnect with Helm](https://developer.konghq.com/gateway/install/kubernetes/konnect.md): Create a Control Plane in Konnect, then deploy a Data Plane to your Kubernetes cluster using Helm. - [Install Kong Gateway on-prem with Helm](https://developer.konghq.com/gateway/install/kubernetes/on-prem.md): Deploy Kong Gateway on Kubernetes in Hybrid mode - [Configure the Admin API with Kong Gateway on Kubernetes](https://developer.konghq.com/gateway/install/kubernetes/on-prem/admin.md): Expose the Kong Gateway Admin API through an Ingress Controller - [Enable Kong Manager with Kong Gateway on Kubernetes](https://developer.konghq.com/gateway/install/kubernetes/on-prem/manager.md): View your Kong Gateway configuration in a UI using Kong Manager - [Convert Gateway entity configuration from 2.8 to 3.4](https://developer.konghq.com/gateway/upgrade/convert-lts-28-34.md): Use decK to upgrade from Kong Gateway 2.8 LTS to 3.4 LTS - [Convert Gateway entity configuration from 3.10 to 3.14](https://developer.konghq.com/gateway/upgrade/convert-lts-310-314.md): Use decK to upgrade from Kong Gateway 3.10 LTS to 3.14 LTS - [Convert Gateway entity configuration from 3.4 to 3.10](https://developer.konghq.com/gateway/upgrade/convert-lts-34-310.md): Use decK to upgrade from Kong Gateway 3.4 LTS to 3.10 LTS - [Migrate from Kong Gateway OSS to Kong Gateway Enterprise](https://developer.konghq.com/gateway/upgrade/migrate-oss-to-ee.md): Learn how to migrate from Kong Gateway open source to Kong Gateway Enterprise using the kong migrations CLI. - [Add Correlation IDs to Kong Gateway logs](https://developer.konghq.com/how-to/add-correlation-ids-to-gateway-logs.md): Learn how to add correlation IDs to logs with the Correlation ID plugin. - [Add custom linting rules in Insomnia](https://developer.konghq.com/how-to/add-custom-linting-rules.md): Learn how to add custom linting rules to your APIs in Insomnia. - [Rate limit a Consumer with Kong Gateway](https://developer.konghq.com/how-to/add-rate-limiting-for-a-consumer-with-kong-gateway.md): Learn how to rate limit a Consumer with the Rate Limiting and Key Authentication plugins. - [Create rate limiting tiers with Kong Gateway](https://developer.konghq.com/how-to/add-rate-limiting-tiers-with-kong-gateway.md): Enforce customized rate limiting tiers by setting individual rate limits for different groups of Consumers. - [Rate limit a Gateway Service with Kong Gateway](https://developer.konghq.com/how-to/add-rate-limiting-to-a-service-with-kong-gateway.md): Learn how to configure rate limiting for a Gateway Service. - [Adjust header names in a request](https://developer.konghq.com/how-to/adjust-header-names-in-request.md): Change the names of headers sent in a request using the Post-Function plugin. - [Allow clients to choose their authentication methods and prevent unauthorized access](https://developer.konghq.com/how-to/allow-multiple-authentication.md): Learn how to allow different clients to access an upstream service with different authentication types, and forbid access to any unauthenticated clients. - [Assign developers to a team with a Dev Portal custom sign-up form](https://developer.konghq.com/how-to/assign-developers-to-a-team-for-dev-portal.md): Learn how to collect a developer's department at sign-up with a Dev Portal custom form, then automatically assign them to the matching RBAC team before approval. - [Automatically create and manage Dev Portal applications in Auth0 with Dynamic Client Registration](https://developer.konghq.com/how-to/auth0-dcr.md): Learn how to configure Dynamic Client Registration to automatically create Dev Portal applications in Auth0. - [Authenticate Consumers with the JWT plugin](https://developer.konghq.com/how-to/authenticate-consumers-jwt.md): Learn how to authenticate Consumers with a signed JWT credential. - [Authenticate Consumers with basic authentication](https://developer.konghq.com/how-to/authenticate-consumers-with-basic-authentication.md): Use the Basic Authentication plugin to allow Consumers to authenticate with a username and password. - [Enable key authentication on a Gateway Service with Kong Gateway](https://developer.konghq.com/how-to/authenticate-consumers-with-key-auth-enc.md): Secure a Gateway Service with the Key Auth Encrypted plugin. - [Authenticate Consumers with the Key Auth and Sessions plugins](https://developer.konghq.com/how-to/authenticate-consumers-with-session-and-key-auth.md): Authenticate Consumers with key authentication and session cookies. - [Authenticate OAuth clients with a Kong Identity authorization server](https://developer.konghq.com/how-to/authenticate-oauth-clients-with-kong-identity.md): Use the OpenID Connect plugin to map authenticated OAuth clients to Kong Identity principals. - [Authenticate Principals with basic authentication](https://developer.konghq.com/how-to/authenticate-principals-with-basic-authentication.md): Use the Basic Authentication plugin to allow Principals to authenticate with a username and password. - [Authenticate Principals with the Key Authentication plugin](https://developer.konghq.com/how-to/authenticate-principals-with-key-auth.md): Use the Key Authentication plugin to allow Principals to authenticate with an API key. - [Automate your API catalog with Terraform](https://developer.konghq.com/how-to/automate-api-catalog-with-terraform.md): Learn how to automate your Dev Portal API catalog with Terraform. - [Automate your API catalog with the Konnect API](https://developer.konghq.com/how-to/automate-api-catalog.md): Learn how to automate your API catalog in Dev Portal using Konnect APIs. - [Manage analytics dashboards with Terraform](https://developer.konghq.com/how-to/automate-dashboard-terraform.md): Learn how to manage a dashboard in Konnect Analytics with Terraform - [Automate tests in Insomnia](https://developer.konghq.com/how-to/automate-tests.md): Automate tests written in Insomnia using the Inso CLI. - [Automatically create and manage Dev Portal applications in Azure AD with Dynamic Client Registration](https://developer.konghq.com/how-to/azure-ad-dcr.md): Learn how to configure Dynamic Client Registration to automatically create Dev Portal applications in Azure AD. - [Configure Azure SAML SSO in Insomnia](https://developer.konghq.com/how-to/azure-saml-sso-insomnia.md): Configure SSO with SAML 2.0 and Azure in Insomnia. - [Block unauthorized requests in Kong Gateway with the OPA plugin](https://developer.konghq.com/how-to/block-unauthorized-requests-with-opa.md): Set up an OPA policy in Kong Gateway to block unauthorized requests. - [Build a custom Docker image](https://developer.konghq.com/how-to/build-custom-docker-image.md): Learn how to build a custom Docker image - [Chain requests in Insomnia](https://developer.konghq.com/how-to/chain-requests.md): Reuse content from a response in another request through Insomnia. - [Run multiple instances of a Kong Gateway plugin](https://developer.konghq.com/how-to/clone-gateway-plugin.md): Create a duplicate of an existing Kong Gateway plugin so that you can run multiple instances of the same plugin with different configurations or in different scopes. - [Collect Konnect audit logs](https://developer.konghq.com/how-to/collect-audit-logs.md): Learn how to configure you SIEM provider to collect Konnect logs and configure a Konnect audit log webhook. - [Collect Dev Portal audit logs](https://developer.konghq.com/how-to/collect-dev-portal-audit-logs.md): Learn how to configure your SIEM provider to collect Konnect Dev Portal logs and configure a Dev Portal audit log webhook. - [Collect metrics, logs, and traces with the OpenTelemetry plugin](https://developer.konghq.com/how-to/collect-metrics-logs-and-traces-with-opentelemetry.md): Use the OpenTelemetry plugin to send Kong Gateway metrics, logs, and traces to OpenTelemetry Collector. - [Collect metrics with Datadog and the Prometheus plugin](https://developer.konghq.com/how-to/collect-metrics-with-datadog-and-prometheus-plugin.md): Learn how to collect metrics from Kong Gateway with Datadog and the Prometheus plugin. - [Collect Kong Gateway metrics with the Prometheus plugin](https://developer.konghq.com/how-to/collect-metrics-with-prometheus.md): Learn how to collect metrics from Kong Gateway with the Prometheus plugin. - [Collect Kong Gateway metrics with the StatsD plugin](https://developer.konghq.com/how-to/collect-metrics-with-statsd.md): Learn how to collect metrics from Kong Gateway with the StatsD plugin. - [Configure AWS Secrets Manager as a vault backend](https://developer.konghq.com/how-to/configure-aws-secrets-manager-as-a-vault-backend-with-vault-entity.md): Learn how to set up AWS Secrets Manager as a Vault in Kong Gateway and reference a secret stored there. - [Configure AWS SES for SMTP emails in Kong Gateway](https://developer.konghq.com/how-to/configure-aws-ses-smtp-for-kong-gateway.md): Learn how to configure Amazon Simple Email Service (SES) as the SMTP provider for Kong Gateway to send emails from Kong Manager. - [Configure Azure Communication Services for SMTP emails in Kong Gateway](https://developer.konghq.com/how-to/configure-azure-smtp-for-kong-gateway.md): Learn how to configure Azure Communication Services as the SMTP provider for Kong Gateway to send emails from Kong Manager. - [Configure CyberArk Secrets Manager (Conjur) as a vault backend](https://developer.konghq.com/how-to/configure-cyberark-as-a-vault-backend.md): Learn how to reference CyberArk Secrets Manager secrets from Kong Gateway. - [Configure the Kong Gateway datastore on Linux](https://developer.konghq.com/how-to/configure-datastore.md): - [Configure a fallback Route](https://developer.konghq.com/how-to/configure-fallback-route.md): Learn how to configure a fallback Route to redirect 404s to a specific upstream service. - [Configure the file system vault backend](https://developer.konghq.com/how-to/configure-file-system-as-a-vault-backend.md): Learn how to store and reference secrets from local files using the Kong Gateway file system vault. - [Configure Google Cloud Secret Manager as a vault backend](https://developer.konghq.com/how-to/configure-google-cloud-secret-as-a-vault-backend.md): Learn how to store a secret in Google Cloud Secret Manager, configure GCP as a Vault entity, and reference the stored secret in Kong Gateway. - [Configure HashiCorp Vault as a vault backend](https://developer.konghq.com/how-to/configure-hashicorp-vault-as-a-vault-backend.md): Learn how to reference HashiCorp Vault secrets from Kong Gateway. - [Configure HashiCorp Vault as a vault backend with AWS EC2 authentication](https://developer.konghq.com/how-to/configure-hashicorp-vault-with-aws-ec2-auth.md): Learn how to configure HashiCorp Vault with AWS EC2 authentication and reference HashiCorp Vault secrets from Kong Gateway. - [Configure HashiCorp Vault as a vault backend with AWS IAM authentication](https://developer.konghq.com/how-to/configure-hashicorp-vault-with-aws-iam-auth.md): Learn how to configure HashiCorp Vault with AWS IAM authentication and reference HashiCorp Vault secrets from Kong Gateway. - [Configure HashiCorp Vault as a vault backend with Azure managed identity authentication](https://developer.konghq.com/how-to/configure-hashicorp-vault-with-azure-auth.md): Learn how to configure HashiCorp Vault with Azure managed identity authentication and reference HashiCorp Vault secrets from Kong Gateway. - [Configure HashiCorp Vault as a vault backend with certificate authentication](https://developer.konghq.com/how-to/configure-hashicorp-vault-with-cert-auth.md): Learn how to configure HashiCorp Vault with certificate authentication and reference HashiCorp Vault secrets from Kong Gateway. - [Configure HashiCorp Vault as a vault backend with GCP service account authentication](https://developer.konghq.com/how-to/configure-hashicorp-vault-with-gcp-service-account-auth.md): Learn how to configure HashiCorp Vault with GCP IAM authentication using a service account and reference HashiCorp Vault secrets from Kong Gateway. - [Configure HashiCorp Vault as a vault backend with GCP workload identity](https://developer.konghq.com/how-to/configure-hashicorp-vault-with-gcp-workload-identity.md): Learn how to configure HashiCorp Vault with GCP GCE authentication using workload identity and reference HashiCorp Vault secrets from Kong Gateway. - [Configure HashiCorp Vault as a vault backend with OAuth2](https://developer.konghq.com/how-to/configure-hashicorp-vault-with-oauth2.md): Learn how to configure HashiCorp Vault with OAuth2 and reference HashiCorp Vault secrets from Kong Gateway. - [Configure the OAuth 2.0 Introspection plugin with Kong Identity](https://developer.konghq.com/how-to/configure-kong-identity-oauth-introspection.md): Learn how to configure Kong Identity with OAuth 2.0 Introspection. - [Configure the OIDC plugin with Kong Identity](https://developer.konghq.com/how-to/configure-kong-identity-oidc.md): Learn how to configure Kong Identity with OIDC. - [Configure the Upstream OAuth plugin with Kong Identity](https://developer.konghq.com/how-to/configure-kong-identity-upstream-oauth.md): Learn how to configure Kong Identity with Upstream OAuth. - [Create and apply Metering & Billing tax codes](https://developer.konghq.com/how-to/configure-metering-and-billing-tax-codes.md): Learn how to review system-managed tax codes, create custom tax codes, and apply them at the organization and rate-card level in Konnect Metering & Billing. - [Configure HTTP logging over mTLS](https://developer.konghq.com/how-to/configure-mtls-for-http-log.md): Learn how to configure the HTTP Log plugin to authenticate with a log server using mutual TLS. - [Dynamically set host based on the authenticated Principal with Datakit](https://developer.konghq.com/how-to/configure-oidc-datakit-host-routing-with-principals-metadata.md): Learn how to store a backend address as Kong Identity Principal metadata, hydrate the Principal with the OpenID Connect plugin, then use the Datakit plugin to route the request to that backend. - [Dynamically set host based on the authenticated caller with Datakit](https://developer.konghq.com/how-to/configure-oidc-datakit-host-routing.md): Learn how to validate a bearer token with the OpenID Connect plugin, extract a claim as a credential, then use the Datakit plugin to route the request directly to a host and port based on that credential. - [Dynamically set upstream based on the authenticated caller with Datakit](https://developer.konghq.com/how-to/configure-oidc-datakit-upstream-routing.md): Learn how to validate a bearer token with the OpenID Connect plugin, extract a claim as a credential, then use the Datakit plugin to route the request to a different upstream based on that credential. - [Configure OpenID Connect with ACL authorization](https://developer.konghq.com/how-to/configure-oidc-with-acl-auth.md): Configure the OpenID Connect and ACL plugins together to apply auth flows to ACL allow or deny lists. - [Configure OpenID Connect with the authorization code flow and Okta](https://developer.konghq.com/how-to/configure-oidc-with-auth-code-flow-and-okta.md): Learn how to configure OpenID Connect with the authorization code flow in Okta. - [Configure OpenID Connect with the authorization code flow](https://developer.konghq.com/how-to/configure-oidc-with-auth-code-flow.md): Learn how to configure OpenID Connect with the authorization code flow in Keycloak. - [Configure OpenID Connect with cert-bound access tokens](https://developer.konghq.com/how-to/configure-oidc-with-cert-bound-tokens.md): Learn how to configure certificate-bound access token authentication with OpenID Connect and TLS Handshake Modifier. - [Configure OpenID Connect with claims-based authorization](https://developer.konghq.com/how-to/configure-oidc-with-claims-based-auth.md): Configure the OpenID Connect plugin for claims-based authorization. - [Configure OpenID Connect with client credentials](https://developer.konghq.com/how-to/configure-oidc-with-client-credentials.md): Set up OpenID Connect with the client credentials grant, which uses a client ID and client secret for authentication. - [Configure OpenID Connect with Consumer Group authorization](https://developer.konghq.com/how-to/configure-oidc-with-consumer-groups.md): Configure the OpenID Connect plugin together with Consumer Groups to map Consumer Groups to IdP client claims. - [Configure OpenID Connect with Consumer authorization](https://developer.konghq.com/how-to/configure-oidc-with-consumers.md): Configure the OpenID Connect plugin together with Consumers to map Consumers to IdP users. - [Configure OpenID Connect with introspection](https://developer.konghq.com/how-to/configure-oidc-with-introspection.md): Set up OpenID Connect with introspection auth, which retrieves a bearer token from the IdP's introspection endpoint for authentication. - [Configure OpenID Connect with JWT authentication](https://developer.konghq.com/how-to/configure-oidc-with-jwt-auth.md): Set up OpenID Connect with JSON Web Token (JWT) auth, which uses a bearer token for authentication with the IdP. - [Configure OpenID Connect with Kong Oauth2 token authentication](https://developer.konghq.com/how-to/configure-oidc-with-kong-oauth2.md): Set up OpenID Connect to verify tokens issued by Kong OAuth 2.0 plugin against an IdP. - [Configure OpenID Connect with multiple IdPs using a trusted issuer registry](https://developer.konghq.com/how-to/configure-oidc-with-multi-idp.md): Learn how to configure the OpenID Connect plugin to validate tokens from multiple identity providers using a trusted issuer registry. - [Configure OpenID Connect with the password grant](https://developer.konghq.com/how-to/configure-oidc-with-password-grant.md): Set up OpenID Connect with the password grant, which uses a username and password pair for authentication. - [Configure OpenID Connect with mTLS Proof-of-Possession via header](https://developer.konghq.com/how-to/configure-oidc-with-pop-token-in-header.md): Learn how to configure the OpenID Connect plugin to validate mTLS Proof-of-Possession tokens when TLS is terminated by a WAF or proxy before Kong Gateway. - [Configure OpenID Connect with refresh token](https://developer.konghq.com/how-to/configure-oidc-with-refresh-token.md): Set up OpenID Connect with the refresh token grant, which looks for a Refresh-Token header. - [Configure OpenID Connect with session authentication](https://developer.konghq.com/how-to/configure-oidc-with-session-auth.md): Set up OpenID Connect with session authentication, which stores credentials in a session cookie and reuses the cookie for subsequent access attempts. - [Configure OpenID Connect with token exchange using Keycloak](https://developer.konghq.com/how-to/configure-oidc-with-token-exchange.md): Learn how to configure OpenID Connect with token exchange in Keycloak. - [Configure OpenID Connect with the user info auth flow](https://developer.konghq.com/how-to/configure-oidc-with-user-info-auth.md): Set up OpenID Connect with the user info auth, which retrieves a bearer token from the IdP's user info endpoint for authentication. - [Configure a Kong Gateway RBAC user with custom permissions](https://developer.konghq.com/how-to/configure-rbac-user-in-kong-gateway.md): Learn how to create a Kong Gateway RBAC user and configure it with roles and permissions. - [Configure SCIM for Insomnia with Azure](https://developer.konghq.com/how-to/configure-scim-for-insomnia-with-azure.md): Learn how to set up SCIM to manage Insomnia users and teams with Azure. - [Configure SCIM for Insomnia with Okta](https://developer.konghq.com/how-to/configure-scim-for-insomnia-with-okta.md): Learn how to set up SCIM to manage Insomnia users and teams with Okta. - [Configure the Konnect Config Store vault](https://developer.konghq.com/how-to/configure-the-konnect-config-store.md): Learn how to use the Konnect Config Store vault. - [Configure third-party Git credentials for Git Sync in Insomnia](https://developer.konghq.com/how-to/configure-third-party-git-credentials-git-sync.md): Configure authentication and commit identity when using Git Sync in Insomnia. - [Connect Azure DevOps repositories to Catalog Classic with the Konnect API](https://developer.konghq.com/how-to/connect-azure-devops-to-the-konnect-catalog-with-the-konnect-api.md): Learn how to connect Azure DevOps repositories to your Catalog Classic services in Konnect using the Konnect API. - [Connect Azure DevOps repositories to Catalog Classic with the Konnect UI](https://developer.konghq.com/how-to/connect-azure-devops-to-the-konnect-catalog-with-the-konnect-ui.md): Learn how to connect Azure DevOps repositories to your Catalog Classic services in Konnect using the UI. - [Create a cloud-hosted mock server in Insomnia](https://developer.konghq.com/how-to/create-a-cloud-hosted-mock-server.md): Create a cloud-hosted mock server in your Insomnia project by choosing the Cloud Mock option. - [Push Event Hook information to Slack with Kong Gateway](https://developer.konghq.com/how-to/create-a-custom-webhook-slack-with-kong-gateway.md): Using an Event Hook and a Slack application URL, create a custom webhook to push information to Slack. - [Create a Key Set with a JSON Web Key](https://developer.konghq.com/how-to/create-a-key-set-with-a-jwk.md): Create a JSON Web Key and add it to a Key Set using the /key-sets API endpoint. - [Create a Key Set with a PEM Key](https://developer.konghq.com/how-to/create-a-key-set-with-a-pem-key.md): Create a PEM Key and add it to a Key Set using the /key-sets API endpoint. - [Create an Event Hook that can run custom code with Kong Gateway](https://developer.konghq.com/how-to/create-a-lambda-event-hook-with-kong-gateway.md): Execute custom Lua code on an event by configuring an Event Hook entity with the lambda handler, - [Configure an Event Hook to log events with Kong Gateway](https://developer.konghq.com/how-to/create-a-log-event-hook-with-kong-gateway.md): Configure an Event Hook to write to the log file every time a CRUD event happens on the Consumer entity. - [Create a Super Admin with the Admin API](https://developer.konghq.com/how-to/create-a-super-admin.md): Learn how to create a Super Admin for Kong Gateway. - [Create a webhook with Kong Gateway](https://developer.konghq.com/how-to/create-a-webhook-with-kong-gateway.md): Configure the Event Hook entity as a webhook to listen for events and push information to the configured URL. - [Create an API Collection in Insomnia](https://developer.konghq.com/how-to/create-an-api-collection.md): Create an API Collection in the Insomnia app, then add an OpenAPI spec to it from the Spec tab. - [Create and publish an Insomnia plugin](https://developer.konghq.com/how-to/create-an-insomnia-plugin.md): Create a NodeJS module in the Insomnia plugins directory and add it to Insomnia. - [Create a centrally-managed Consumer in Konnect](https://developer.konghq.com/how-to/create-centrally-managed-consumer.md): Learn how to create a realm and authenticate a centrally-managed Consumer with key authentication. - [Create a dashboard from a template](https://developer.konghq.com/how-to/create-custom-dashboards.md): Learn how to create a dashboard from a template in Konnect Analytics. - [Create a custom vault backend](https://developer.konghq.com/how-to/create-custom-vault.md): Learn how to write a custom vault backend for Kong Gateway and use it to inject secrets into plugin configuration at request time. - [Create a Transit Gateway with Kong Operator and AWS](https://developer.konghq.com/how-to/create-transit-gateway-with-operator-and-aws.md): Create a KonnectCloudGatewayTransitGateway resource with Kong Operator and AWS. - [Automatically create and manage Dev Portal applications in Curity with Dynamic Client Registration](https://developer.konghq.com/how-to/curity-dcr.md): Learn how to configure Dynamic Client Registration to automatically create Dev Portal applications in Curity. - [Discover and govern APIs with Catalog Classic](https://developer.konghq.com/how-to/discover-and-govern-apis-with-service-catalog.md): Learn how to discover APIs in AWS API Gateway, SwaggerHub, and GitHub with Catalog Classic and govern them with scorecards. - [Discover AWS Gateway APIs in Catalog Classic with the Konnect API](https://developer.konghq.com/how-to/discover-aws-gateway-apis-using-konnect-api.md): Learn how to connect an AWS Gateway API to your Catalog Classic service in Konnect using the API. - [Discover AWS Gateway APIs in Catalog Classic with the Konnect UI](https://developer.konghq.com/how-to/discover-aws-gateway-apis-using-konnect-ui.md): Learn how to connect an AWS Gateway API to your Catalog Classic service in Konnect using the UI. - [Discover Azure API Management APIs in Catalog Classic with the Konnect API](https://developer.konghq.com/how-to/discover-azure-apis-with-konnect-api.md): Learn how to connect an Azure API Management API to your Catalog Classic service in Konnect using the API. - [Discover Azure API Management APIs in Catalog Classic with the Konnect UI](https://developer.konghq.com/how-to/discover-azure-apis-with-konnect-ui.md): Learn how to connect an Azure API Management API to your Catalog Classic service in Konnect using the UI. - [Install Insomnia on Windows](https://developer.konghq.com/how-to/download-insomnia-for-windows.md): Learn how to install Insomnia on a Windows device. - [Enable Basic Auth for Kong Manager](https://developer.konghq.com/how-to/enable-basic-auth-on-kong-manager.md): Learn how to enable basic authentication and RBAC for Kong Manager. - [Enable key authentication for Dev Portal apps](https://developer.konghq.com/how-to/enable-key-auth-for-dev-portal.md): Learn how to allow Dev Portal developers to authenticate with apps using key auth. - [Enable key authentication on a Gateway Service with Kong Gateway](https://developer.konghq.com/how-to/enable-key-authentication-on-a-service-with-kong-gateway.md): Enable the Key Authentication plugin on a Gateway Service to require Consumers to authenticate with an API key. - [Enable OAuth 2.0 authentication for WebSocket requests](https://developer.konghq.com/how-to/enable-oauth2-authentication-for-websocket-requests.md): Create an OAuth 2.0 Client Credentials flow for a WebSocket Gateway Service. - [Enable OAuth 2.0 authentication with Kong Gateway](https://developer.konghq.com/how-to/enable-oauth2-authentication-with-kong-gateway.md): Create an OAuth 2.0 Client Credentials flow for a Gateway Service. - [Enable self-managed OIDC auth with Okta in Dev Portal](https://developer.konghq.com/how-to/enable-oidc-auth-for-dev-portal.md): Learn how to allow Dev Portal developers to self-manage OIDC apps in Okta. - [Enable RBAC with the Admin API](https://developer.konghq.com/how-to/enable-rbac-with-admin-api.md): Learn how to enable Role-Based Access Control for Kong Gateway using the Admin API. - [Enable SAML authentication using Microsoft Entra](https://developer.konghq.com/how-to/enable-saml-authentication-with-microsoft-entra.md): Use the SAML plugin to enable SAML authentication for users configured in Microsoft Entra. - [Enable authentication with Vault in Kong Gateway](https://developer.konghq.com/how-to/enable-vault-authentication.md): Use the Vault Authentication plugin to secure access to your Kong Gateway resources. - [Encrypt sensitive data in Kong Gateway with a Keyring](https://developer.konghq.com/how-to/encrypt-sensitive-data-in-kong-gateway-with-keyring.md): Enable Keyring encryption in Kong Gateway to encrypt sensitive data in Gateway and plugin configuration. - [Filter requests based on header names](https://developer.konghq.com/how-to/filter-requests-based-on-header-names.md): Use the Pre-Function plugin to detect headers in a request, and either let the request through or terminate it. - [Generate requests from an API spec in Insomnia](https://developer.konghq.com/how-to/generate-requests-from-an-api-spec.md): Learn how to add a request to an API Collection for each endpoint in your OpenAPI spec. - [Get started with Datakit](https://developer.konghq.com/how-to/get-started-with-datakit.md): Learn how to configure the Datakit plugin. - [Get started with Metering & Billing generic meters](https://developer.konghq.com/how-to/get-started-with-metering-and-billing-generic-meters.md): Learn how to meter and bill AI agent runs using generic metering in Konnect Metering & Billing. - [Get started with prepaid credits](https://developer.konghq.com/how-to/get-started-with-prepaid-credits.md): Configure a credits-only billing plan, create a customer, start a subscription, and issue a prepaid credit grant in Konnect Metering & Billing. - [Import an API specification into an API Collection in Insomnia](https://developer.konghq.com/how-to/import-an-api-spec.md): Import an API specification into Insomnia from a file, URL, or your clipboard. - [Import content from Postman to multiple Insomnia projects](https://developer.konghq.com/how-to/import-content-from-postman-to-multiple-insomnia-projects.md): Use the Postman Exporter tool to export, organize, and import your Postman content to multiple Insomnia projects. - [Install and map Datadog resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-datadog-resources.md): Learn how to connect Datadog monitors and dashboards to your Catalog Classic service in Konnect. - [Install and map GitHub resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-github-resources.md): Learn how to connect a GitHub repository to your Catalog Classic service in Konnect. - [Install and map self-hosted GitLab resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-gitlab-resources.md): Learn how to connect a GitLab project to your Catalog Classic service in Konnect. - [Install and map SaaS GitLab resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-gitlab-saas-resources.md): Learn how to connect a SaaS GitLab project to your Catalog Classic service in Konnect. - [Import and map PagerDuty resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-pagerduty-resources.md): Learn how to connect PagerDuty services to your Catalog Classic service in Konnect. - [Import and map Slack resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-slack-resources.md): Learn how to connect Slack channels to your Catalog Classic service in Konnect. - [Import and map SwaggerHub resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-swaggerhub-resources.md): Learn how to connect SwaggerHub API versions to your Catalog Classic service in Konnect. - [Import and map Traceable resources in Catalog Classic](https://developer.konghq.com/how-to/install-and-map-traceable-resources.md): Learn how to connect Traceable services to your Catalog Classic service in Konnect. - [Automatically create Dev Portal applications in Kong Identity with Dynamic Client Registration](https://developer.konghq.com/how-to/kong-identity-dcr.md): Learn how to configure Dynamic Client Registration to automatically create Dev Portal applications in Kong Identity. - [Link a Konnect Service to Insomnia](https://developer.konghq.com/how-to/link-konnect-to-insomnia.md): Link Insomnia to Konnect and send requests against a Route in your Kong Gateway Service. - [Manage secrets in Insomnia with 1Password](https://developer.konghq.com/how-to/manage-secrets-in-insomnia-with-1password.md): Use the Insomnia 1Password plugin to retrieve secrets from a 1Password vault and use them in your requests. - [Map Observability reports in Catalog Classic](https://developer.konghq.com/how-to/map-analytics-resources.md): Learn how to map Konnect analytics resources in Catalog Classic to visualize Observability Reports. - [Map API Gateway Services in Catalog Classic](https://developer.konghq.com/how-to/map-api-gateway-resources.md): Learn how to map Gateway Services from Konnect API Gateway in Catalog Classic to visualize services across multiple Control Planes. - [Map Service Mesh services in Catalog Classic](https://developer.konghq.com/how-to/map-service-mesh-resources.md): Learn how to map Service Mesh resources in Catalog Classic to gain visibility into how the service is deployed across meshes and zones. - [Map URIs into GraphQL queries with DeGraphQL](https://developer.konghq.com/how-to/map-uris-into-graphql-queries.md): Learn how to use the DeGraphQL plugin to map URIs into GraphQL queries. - [Meter and bill active users with Metering & Billing generic meters](https://developer.konghq.com/how-to/meter-and-bill-active-users.md): Learn how to meter and bill active users using generic metering in Konnect Metering & Billing. - [Track API requests by Consumer with Metering & Billing](https://developer.konghq.com/how-to/meter-api-requests-by-consumer.md): Learn how to use the Metering & Billing plugin on a self-managed Kong Gateway to emit per-Consumer API usage events to Konnect Metering & Billing. - [Migrate collections and environments from Postman to Insomnia](https://developer.konghq.com/how-to/migrate-collections-and-environments-from-postman-to-insomnia.md): Migrate Postman collections and environments to Insomnia. - [Monitor Dynatrace classic SLOs in Catalog Classic with the Konnect API](https://developer.konghq.com/how-to/monitor-dynatrace-slos-with-konnect-api.md): Learn how to connect a Dynatrace classic SLO to your Catalog Classic service in Konnect using the API. - [Monitor Dynatrace classic SLOs in Catalog Classic with the Konnect UI](https://developer.konghq.com/how-to/monitor-dynatrace-slos-with-konnect-ui.md): Learn how to connect a Dynatrace classic SLO to your Catalog Classic service in Konnect using the UI. - [Monitor SonarQube projects in Catalog Classic with the Konnect API](https://developer.konghq.com/how-to/monitor-sonarqube-projects-with-konnect-api.md): Learn how to connect a SonarQube project to your Catalog Classic service in Konnect using the API. - [Monitor SonarQube projects in Catalog Classic with the Konnect UI](https://developer.konghq.com/how-to/monitor-sonarqube-projects-with-konnect-ui.md): Learn how to connect a SonarQube project to your Catalog Classic service in Konnect using the UI. - [Apply multiple rate limits and window sizes](https://developer.konghq.com/how-to/multiple-rate-limits-window-sizes.md): Learn how to configure the Rate Limiting Advanced plugin to apply multiple rate limits and window sizes. - [Automatically create Dev Portal applications in Okta with Dynamic Client Registration](https://developer.konghq.com/how-to/okta-dcr.md): Learn how to configure Dynamic Client Registration to automatically create Dev Portal applications in Okta. - [Configure Okta OpenID Connect SSO in Insomnia](https://developer.konghq.com/how-to/okta-oidc-sso-insomnia.md): Learn how to secure Insomnia by setting up OIDC single sign-on (SSO) with Okta. - [Configure Okta SAML SSO in Insomnia](https://developer.konghq.com/how-to/okta-saml-sso-insomnia.md): Learn how to secure Insomnia by setting up SAML single sign-on (SSO) with Okta. - [Package APIs with Dev Portal](https://developer.konghq.com/how-to/package-apis-with-dev-portal.md): Learn how to compose existing APIs in Dev Portal into API packages. - [Protect against brute force attacks with basic authentication](https://developer.konghq.com/how-to/protect-against-brute-force-attacks.md): Use the Basic Authentication plugin to protect against brute force attacks. - [Rate limit requests based on peak and off-peak time](https://developer.konghq.com/how-to/rate-limit-based-on-peak-time.md): Using the Pre-function and the Rate Limiting Advanced plugins, set the rate limit based on peak or non-peak time. - [Recover Dev Portal audit logs](https://developer.konghq.com/how-to/recover-dev-portal-audit-logs.md): Learn how to recover Konnect Dev Portal audit logs using replay jobs. - [Recover Konnect audit logs](https://developer.konghq.com/how-to/recover-konnect-org-audit-logs.md): Learn how to recover Konnect org audit logs using replay jobs. - [How to restart Kong Gateway in a Docker container](https://developer.konghq.com/how-to/restart-kong-gateway-container.md): Restart the Kong Gateway container without killing it. - [How to restart Kong Gateway on Kubernetes](https://developer.konghq.com/how-to/restart-kong-gateway-kubernetes.md): Apply a kong.conf change to a Helm-deployed data plane by replacing pods instead of running kong reload. - [Restrict access to Kong Gateway resources by allowing specific IPs](https://developer.konghq.com/how-to/restrict-access-to-resources-by-allowing-ips.md): Enable the IP Restriction plugin to instruct Kong Gateway to only accept requests from specific IP addresses. - [Review partner API access requests with Dev Portal custom forms](https://developer.konghq.com/how-to/review-partner-api-access-requests-for-dev-portal.md): Learn how to collect company and business justification details from partner developers before approving Dev Portal and API access, using Dev Portal custom forms. - [Rotate secrets for an authorization server client](https://developer.konghq.com/how-to/rotate-auth-server-client-secrets.md): Learn how to rotate the client secrets for an authorization server client with no downtime. - [Restart Kong Gateway when a mounted certificate changes](https://developer.konghq.com/how-to/rotate-kong-conf-certificates-with-reloader.md): Use Stakater Reloader to roll out Kong Gateway pods automatically when cert-manager updates a mounted TLS Secret. - [Route requests to backup Targets during failures](https://developer.konghq.com/how-to/route-requests-to-backup-targets.md): Use the Route by Header plugin to route requests based on a header value. - [Route requests to different Upstreams based on headers](https://developer.konghq.com/how-to/route-requests-to-different-upstreams-based-on-headers.md): Use the Route by Header plugin to route requests based on a header value. - [Run Inso CLI on Docker](https://developer.konghq.com/how-to/run-inso-cli-on-docker.md): Inso CLI is available as a Docker image. - [Send OpenTelemetry data to Grafana Cloud](https://developer.konghq.com/how-to/send-otel-data-to-grafana-cloud.md): Use the OpenTelemetry plugin to send metrics, logs, and traces to Grafana Cloud and visualize them in a dashboard. - [Set a value from a response as an environment variable in Insomnia](https://developer.konghq.com/how-to/set-a-value-from-a-response-as-an-environment-variable.md): Send a request, then create an after-response script to get the value you want to use and set it as an environment variable. - [Set up a built-in Kubernetes gateway with Kong Mesh](https://developer.konghq.com/how-to/set-up-a-built-in-kubernetes-gateway.md): This guide walks through setting up a built-in Kubernetes gateway, defining Routes, securing traffic with TLS, and configuring permissions. - [Set up a built-in gateway with Kong Mesh](https://developer.konghq.com/how-to/set-up-a-built-in-mesh-gateway.md): This guide walks through setting up MeshGatewayInstance and MeshGateway resources, defining Routes with MeshHTTPRoute, configuring permissions, and securing the gateway with TLS. - [Set up Dynatrace with OpenTelemetry](https://developer.konghq.com/how-to/set-up-dynatrace-with-otel.md): Use Dynatrace SaaS to send analytics and monitoring data to Dynatrace dashboards. - [Set up Jaeger with OpenTelemetry](https://developer.konghq.com/how-to/set-up-jaeger-with-otel.md): Use the OpenTelemetry plugin to send Kong Gateway analytics and monitoring data to Jaeger dashboards. - [Sign Kong Gateway audit logs with an RSA key](https://developer.konghq.com/how-to/sign-gateway-audit-logs.md): Use a key pair to sign audit logs in Kong Gateway. - [Store Keyring data in a HashiCorp Vault](https://developer.konghq.com/how-to/store-keyring-in-hashicorp-vault.md): Learn how to store Keyring data in a HashiCorp Vault. - [Store the Kong Gateway database credentials with AWS Secrets Manager](https://developer.konghq.com/how-to/store-the-gateway-database-credentials-with-aws-secrets-manager.md): Learn how to store your Kong Gateway PostgreSQL credentials in AWS Secrets Manager. - [Stream Kong Gateway plugins](https://developer.konghq.com/how-to/stream-custom-plugins.md): Define custom plugins directly in Kong Gateway entity configuration and distribute them to all data planes automatically. - [Synchronize an Insomnia project with Git](https://developer.konghq.com/how-to/synchronize-with-git.md): Create a new Insomnia project and enable Git Sync. - [Test certificate generation locally with ngrok and the ACME plugin](https://developer.konghq.com/how-to/test-certificate-generation-locally-with-ngrok-and-acme.md): Use ngrok and the ACME plugin to test certificate generation locally. - [Throttle APIs with different rate limits for Services and Consumers](https://developer.konghq.com/how-to/throttle-apis-with-services-and-consumers.md): Use the Rate Limiting and Service Protection plugins to set different rate limits for Services and Consumers. - [Customize a 404 error message](https://developer.konghq.com/how-to/transform-a-404-response-message.md): Use the Exit Transformer plugin to transform a 404 response before returning it to the client. - [Transform a client request in Kong Gateway](https://developer.konghq.com/how-to/transform-a-client-request.md): Use the Request Transformer Advanced plugin to transform a client request before proxying it. - [Use the ACL plugin with Consumer Groups in Kong Gateway](https://developer.konghq.com/how-to/use-acl-with-consumer-groups.md): Restrict access to your resources based on Consumer Groups with the ACL plugins. - [Use an Azure Function through Kong Gateway](https://developer.konghq.com/how-to/use-an-azure-function-through-gateway.md): Learn how to configure the Azure Functions plugin to invoke an Azure Function in a Route. - [Use Git CLI in an Insomnia project](https://developer.konghq.com/how-to/use-git-cli.md): Use the native Git CLI at the root of an Insomnia project. - [Use the gRPC-Gateway plugin to proxy HTTP requests to a gRPC service](https://developer.konghq.com/how-to/use-grpc-gateway.md): Set up the gRPC-Gateway plugin to proxy requests using a Protobuf definition. - [Use the gRPC-Web plugin to proxy HTTP requests to a gRPC service](https://developer.konghq.com/how-to/use-grpc-web.md): Set up the gRPC-Web plugin to proxy requests using a Protobuf definition. - [Use Insomnia MCP clients to test aggregated MCP tools](https://developer.konghq.com/how-to/use-insomnia-mcp-clients-to-test-aggregated-mcp-tools.md): Learn how to use Insomnia 12.1 MCP clients to test MCP tools exposed by AI MCP Proxy in listener mode after they have been aggregated from multiple upstream APIs. - [Use the Collection Runner in Insomnia](https://developer.konghq.com/how-to/use-the-collection-runner.md): Use the Collection Runner to run multiple requests in a specific order. - [Validate incoming JSON request bodies with JSON Threat Protection](https://developer.konghq.com/how-to/validate-incoming-json-request-bodies.md): Use the JSON Threat Protection plugin to enforce a JSON threat protection policy. - [Verify build provenance for signed Kong Gateway images](https://developer.konghq.com/how-to/verify-build-provenance-for-signed-images.md): Use Cosign and regctl to verify build provenance for signed Kong Gateway images. - [Verify a Datakit call node's TLS connection using a custom CA](https://developer.konghq.com/how-to/verify-datakit-call-with-custom-ca.md): Learn how to configure the Datakit plugin's call node to verify TLS against a private certificate authority instead of the global trusted CA store. - [Verify signatures for signed Kong Gateway images](https://developer.konghq.com/how-to/verify-signatures-for-signed-images.md): Use Cosign and regctl to verify signatures for signed Kong Gateway images. - [Write an after-response script to test a response in Insomnia](https://developer.konghq.com/how-to/write-after-response-script.md): Write an after-response script to check that the response body contains the expected value. - [Write tests for content types in Insomnia](https://developer.konghq.com/how-to/write-content-type-tests.md): Learn how to write content type tests in Insomnia. - [Write tests for data types in Insomnia](https://developer.konghq.com/how-to/write-data-type-tests.md): Learn how to write data type tests in Insomnia. - [Write tests for headers in the response in Insomnia](https://developer.konghq.com/how-to/write-headers-in-response-tests.md): Learn how to write header tests in Insomnia. - [Write tests for HTTP status codes in Insomnia](https://developer.konghq.com/how-to/write-http-status-tests.md): Learn how to write HTTP status code tests in Insomnia. - [Write a pre-request script to add an environment variable in Insomnia](https://developer.konghq.com/how-to/write-pre-request-scripts.md): Write a pre-request script to dynamically set a variable in a request. - [Get started with kongctl](https://developer.konghq.com/kongctl/get-started.md): Learn how to use kongctl to manage Kong Konnect resources - [Configure SAML SSO for Konnect with Microsoft Entra ID](https://developer.konghq.com/konnect-platform/entra-saml-sso.md): Learn how to configure SAML 2.0 SSO for Konnect using Microsoft Entra ID as the identity provider. - [Deploy Konnect Reference Platform](https://developer.konghq.com/konnect-reference-platform/how-to.md): How to deploy the Konnect Reference Platform - [ACL](https://developer.konghq.com/kubernetes-ingress-controller/acl.md): Apply the ACL plugin to provide access control for specific routes - [Deploy custom plugins](https://developer.konghq.com/kubernetes-ingress-controller/custom-plugins.md): Install custom plugins in Kong Gateway without using a custom image - [Degraphql](https://developer.konghq.com/kubernetes-ingress-controller/degraphql.md): Configure the DeGraphQL plugin for Kong Ingress Controller using KongCustomEntity. - [Backfill broken objects with fallback configuration](https://developer.konghq.com/kubernetes-ingress-controller/fallback-configuration/backfill.md): Use the last known good configuration automatically for any subset of configuration that is invalid in your k8s cluster - [Exclude broken objects with fallback configuration](https://developer.konghq.com/kubernetes-ingress-controller/fallback-configuration/exclude.md): Remove broken configuration from your Kong Gateway configuration automatically - [Key Authentication](https://developer.konghq.com/kubernetes-ingress-controller/get-started/key-authentication.md): Add key authentication to a Kubernetes Service using the KongPlugin resource - [Proxy Caching](https://developer.konghq.com/kubernetes-ingress-controller/get-started/proxy-caching.md): Cache all GET and HEAD responses across all Services using Proxy Cache and the KongClusterPlugin resource - [Rate Limiting](https://developer.konghq.com/kubernetes-ingress-controller/get-started/rate-limiting.md): Add rate limiting to an HTTPRoute or Ingress using the KongPlugin resource - [Services and Routes](https://developer.konghq.com/kubernetes-ingress-controller/get-started/services-and-routes.md): Use the an HTTPRoute or Ingress to configure a Service and a Route. - [Install Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller/install.md): Run Kong Ingress Controller with Konnect or on-prem using Helm - [Customize load balancing with KongUpstreamPolicy](https://developer.konghq.com/kubernetes-ingress-controller/load-balancing.md): Change the load balancing algorithm to consistent-hashing based on an incoming header - [mTLS](https://developer.konghq.com/kubernetes-ingress-controller/mtls.md): Configure the Kong Ingress Controller to verify client certificates using CA certificates and mtls-auth plugin for HTTPS requests. - [Support multiple authentication methods](https://developer.konghq.com/kubernetes-ingress-controller/multiple-auth-methods.md): Enable multiple authentication methods on a single Service - [Monitor metrics with Prometheus and Grafana](https://developer.konghq.com/kubernetes-ingress-controller/observability/prometheus-grafana.md): Monitor Kong Gateway Prometheus metrics using Kong Ingress Controller and Grafana - [OIDC with Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller/oidc.md): Authenticate requests using the OpenID Connect protocol and Kong Gateway - [Rate limiting with Kong Ingress Controller](https://developer.konghq.com/kubernetes-ingress-controller/rate-limiting.md): Configure Rate Limiting using a `local` or `redis` policy - [Configure Gateway API resources across namespaces](https://developer.konghq.com/kubernetes-ingress-controller/routing/cross-namespace.md): Route traffic to a Service in a different namespace using ReferenceGrant - [Configure an ExternalService](https://developer.konghq.com/kubernetes-ingress-controller/routing/external-service.md): Expose a service located outside the Kubernetes cluster - [Proxy GRPC Traffic over HTTP](https://developer.konghq.com/kubernetes-ingress-controller/routing/grpc-over-http.md): Use GRPCRoute to route traffic to a plain text GRPC listener - [Proxy GRPC Traffic over TLS](https://developer.konghq.com/kubernetes-ingress-controller/routing/grpc.md): Use GRPCRoute to route traffic to a service secured with TLS - [Redirect HTTP to HTTPS](https://developer.konghq.com/kubernetes-ingress-controller/routing/http-to-https.md): Redirect incoming HTTP requests to use HTTPS - [Proxy HTTP Traffic](https://developer.konghq.com/kubernetes-ingress-controller/routing/http.md): Route HTTP requests to services in your cluster using HTTPRoute or Ingress - [Proxy HTTPS Traffic with TLS Termination](https://developer.konghq.com/kubernetes-ingress-controller/routing/https-tls-termination.md): Route HTTPS requests to services in your cluster using HTTPRoute or Ingress - [Rewrite paths with the konghq.com/rewrite annotation](https://developer.konghq.com/kubernetes-ingress-controller/routing/rewriting-paths.md): Dynamically rewrite paths using regular expressions before sending requests upstream - [Rotate TLS certificates without restarting Kong Gateway](https://developer.konghq.com/kubernetes-ingress-controller/routing/rotate-tls-certificates.md): Let cert-manager rotate a TLS certificate and have Kong Gateway serve it without a reload or a pod restart. - [Proxy TCP traffic by port](https://developer.konghq.com/kubernetes-ingress-controller/routing/tcp-by-port.md): Route TCP requests to services in your cluster based on the incoming port using TCPRoute or TCPIngress - [Proxy TCP traffic over TLS by SNI](https://developer.konghq.com/kubernetes-ingress-controller/routing/tcp-by-sni.md): Use TLSRoute to route TCP traffic secured by TLS - [Proxy UDP traffic by port](https://developer.konghq.com/kubernetes-ingress-controller/routing/udp-by-port.md): Route UDP requests to services in your cluster using UDPRoute or UDPIngress - [Weight traffic to specific backends](https://developer.konghq.com/kubernetes-ingress-controller/routing/weights.md): Distribute traffic across multiple Kubernetes Services in a single HTTPRoute - [Configure Service health checks](https://developer.konghq.com/kubernetes-ingress-controller/service-health-checks.md): How to enable passive and active health checks for upstream services - [Configure sticky sessions with drain support](https://developer.konghq.com/kubernetes-ingress-controller/sticky-sessions-with-drain-support.md): Learn how to implement sticky sessions with graceful draining of terminating pods using Kong Ingress Controller. - [Manage sticky sessions with KongUpstreamPolicy](https://developer.konghq.com/kubernetes-ingress-controller/sticky-sessions.md): Configure sticky sessions to ensure client requests are routed to the same backend pod using KongUpstreamPolicy - [Configure an AWS Secrets Manager Vault](https://developer.konghq.com/kubernetes-ingress-controller/vault/aws.md): Configure Secrets Manager AWS Vault with Kong Ingress Controller and the KongVault CRD - [Configure a GCP Secret Manager Vault](https://developer.konghq.com/kubernetes-ingress-controller/vault/gcp.md): Configure GCP Secret Manager Vault with Kong Ingress Controller and the KongVault CRD - [Configure Hashicorp Vault](https://developer.konghq.com/kubernetes-ingress-controller/vault/hashicorp.md): Configure Hashicorp Vault with Kong Ingress Controller and the KongVault CRD - [Verify Upstream TLS](https://developer.konghq.com/kubernetes-ingress-controller/verify-upstream-tls.md): Learn how to configure Kong Gateway to verify TLS certificates when connecting to upstream services. - [Configure inbound traffic with the rules API](https://developer.konghq.com/mesh/configure-inbound-traffic-rules-api.md): Apply policies to data plane inbounds using the rules API with the Dataplane targetRef kind. - [Configure a Kong Mesh global control plane on Kubernetes with the Konnect API](https://developer.konghq.com/mesh/configure-mesh-global-control-plane-on-kubernetes-with-konnect-api.md): Use the Konnect API to create a global control plane, provision a zone token, deploy the Kubernetes demo app, and test your Kong Mesh mesh. - [Configure a Kong Mesh global control plane on Kubernetes with the Konnect UI](https://developer.konghq.com/mesh/configure-mesh-global-control-plane-on-kubernetes-with-konnect-ui.md): Use the Konnect UI to create a global control plane, add a zone, deploy the Kubernetes demo app, and test your Kong Mesh mesh. - [Configure a Kong Mesh global control plane on Universal with the Konnect API](https://developer.konghq.com/mesh/configure-mesh-global-control-plane-on-universal-with-konnect-api.md): Use the Konnect API to create a global control plane and zone token, then deploy a Universal zone control plane that connects to Konnect. - [Configure a Kong Mesh global control plane on Universal with the Konnect UI](https://developer.konghq.com/mesh/configure-mesh-global-control-plane-on-universal-with-konnect-ui.md): Use the Konnect UI to create a global control plane and connect a Universal zone control plane. - [Use namespace-scoped Kong Mesh policies](https://developer.konghq.com/mesh/consumer-producer-policies.md): Learn how to define namespace-scoped producer and consumer policies in Kong Mesh using a demo application. - [Deploy an OpenTelemetry collector for metrics, traces, and logs](https://developer.konghq.com/mesh/deploy-an-opentelemetry-collector.md): Run a per-node OpenTelemetry collector DaemonSet that receives metrics, traces, and access logs from Kong Mesh sidecars and forwards them to your backends. - [Deploy Mesh on Kubernetes](https://developer.konghq.com/mesh/deploy-mesh-on-kubernetes.md): Learn how to install Mesh on an existing Kubernetes cluster, and deploy the Kong Mesh demo application. - [Deploy Self Managed Control Plane on Kubernetes](https://developer.konghq.com/mesh/deploy-mesh-self-managed.md): Learn how to install Mesh Control plane on an existing Kubernetes cluster, and deploy the Kong Mesh demo application. - [Deploy Kong Mesh using Terraform and Konnect](https://developer.konghq.com/mesh/deploy-mesh-using-terraform-and-konnect.md): Use Terraform to provision a Konnect-managed global control plane, a mesh, and a policy, then deploy a Kubernetes zone control plane. - [Deploy a multi-zone global Kong Mesh control plane in Universal mode with Docker](https://developer.konghq.com/mesh/deploy-multi-zone-global-control-plane-universal-docker.md): Run a multi-zone Kong Mesh deployment in Universal mode using Docker containers: a PostgreSQL database, a global control plane, a zone control plane, and a zone ingress. - [Deploy a self-managed control plane on a VM or Bare metal](https://developer.konghq.com/mesh/deploy-universal-self-managed.md): Learn how to install Mesh on Virtual Machines or Bare metal, and deploy the Kong Mesh demo application. - [Federate a zone control plane to Konnect](https://developer.konghq.com/mesh/federate-zone-control-plane-to-konnect.md): Federate a single-zone Kong Mesh control plane to Konnect and enable a multi-zone service mesh. - [Federate a zone control plane](https://developer.konghq.com/mesh/federate.md): Learn how to federate a zone control plane into a multi-zone deployment. This guide walks through setting up a global control plane, copying resources, connecting zones, and verifying policy synchronization. - [Set up the Kong Mesh control plane](https://developer.konghq.com/mesh/get-started/universal/control-plane.md): Start the Kong Mesh control plane as a Docker container and configure kumactl to connect to it. - [Set up a Kong Mesh demo application](https://developer.konghq.com/mesh/get-started/universal/demo-app.md): Deploy the demo-app service as a Docker container and configure a data plane proxy and transparent proxy in Kong Mesh Universal mode. - [Install Kong Mesh](https://developer.konghq.com/mesh/get-started/universal/install.md): Install Kong Mesh, prepare working directories and configuration files, and create a Docker network for the Universal mode demo. - [Set up the Kong Mesh key/value store](https://developer.konghq.com/mesh/get-started/universal/kv.md): Deploy the kv service as a Docker container and configure a data plane proxy and transparent proxy in Kong Mesh Universal mode. - [Introduce zero-trust security with Kong Mesh](https://developer.konghq.com/mesh/get-started/universal/zero-trust-security.md): Enable mTLS and configure the built-in gateway to secure Kong Mesh services and allow external traffic into the mesh. - [Issue identity with MeshIdentity Spire provider](https://developer.konghq.com/mesh/issue-identity-with-meshidentity-spire.md): Learn how to issue SPIFFE-compliant identities using MeshIdentity with the Spire provider and configure MeshTrafficPermission with SPIFFE ID matching. - [Issue identity with the MeshIdentity bundled provider](https://developer.konghq.com/mesh/issue-identity-with-meshidentity.md): Learn how to issue SPIFFE-compliant identities using MeshIdentity with the bundled provider and configure MeshTrafficPermission with SPIFFE ID matching. - [Deploy Kong Mesh on Kubernetes](https://developer.konghq.com/mesh/kubernetes.md): Start learning how Kong Mesh works by running and securing a simple demo application that consists of two services. - [Migrate a self-managed zone control plane to Konnect](https://developer.konghq.com/mesh/migrate-self-managed-zone-to-konnect.md): Move your existing Kong Mesh zone control planes from a self-managed global control plane to a Konnect-managed global control plane. - [Migrate to the new policies](https://developer.konghq.com/mesh/migration-to-the-new-policies.md): Migrate from old to new policies in Kong Mesh to improve flexibility and transparency. - [Progressively roll out unified resource naming](https://developer.konghq.com/mesh/progressively-roll-out-unified-resource-naming.md): Enable unified resource naming for predictable Envoy stats that map directly to mesh resources. - [Progressively roll in strict mTLS with Kong Mesh](https://developer.konghq.com/mesh/progressively-rolling-in-strict-mtls.md): Progressively roll in mutual TLS with the MeshTLS policy in Kong Mesh without disrupting traffic. - [Restrict Kong Mesh permissions to selected namespaces on Kubernetes](https://developer.konghq.com/mesh/restrict-permissions-to-selected-namespaces-on-kubernetes.md): This guide explains how to limit Kong Mesh to specific namespaces, giving you greater control over security and resource management. - [Use cert-manager for control plane certificates](https://developer.konghq.com/mesh/use-cert-manager-for-control-plane-certificates.md): Learn how to use cert-manager to provision and rotate TLS certificates for the Kong Mesh control plane on Kubernetes. - [Kong Gateway as a delegated gateway with Kong Mesh](https://developer.konghq.com/mesh/use-kong-as-delegated-gateway.md): Set up Kong Gateway as a delegated gateway for to expose internal services to external traffic. - [Deploy mesh-scoped zone proxies](https://developer.konghq.com/mesh/zone-proxies.md): Deploy Kong Mesh zone ingress and zone egress with per-mesh Helm values. Each entry in `kuma.meshes[]` creates the Deployment, Service, and Dataplane listeners for one mesh. - [Apply policies to mesh-scoped zone proxies](https://developer.konghq.com/mesh/zone-proxy-policies.md): Target mesh-scoped zone ingress and zone egress with MeshTrafficPermission, MeshMetric, and MeshAccessLog. - [Get started with Entitlement Enforcement](https://developer.konghq.com/metering-and-billing/entitlement-enforcement/get-started.md): Learn how to enforce per-customer entitlements on Kong Gateway traffic with the Entitlement Enforcement plugin and Metering & Billing in Konnect. - [Get started with Metering & Billing in Konnect](https://developer.konghq.com/metering-and-billing/get-started.md): Learn how to meter and monetize API Gateway requests with Konnect and Metering & Billing. - [Autoscale workloads with Datadog](https://developer.konghq.com/operator/dataplanes/how-to/autoscale-workloads/datadog.md): Use the Gateway Operator and Datadog metrics to automatically scale Kong Gateway Data Plane workloads. - [Autoscale workloads with Prometheus](https://developer.konghq.com/operator/dataplanes/how-to/autoscale-workloads/prometheus.md): Use Prometheus and the Gateway Operator to scale Data Plane workloads based on latency or other metrics exposed through the `/metrics` endpoint. - [Automate TLS certificate provisioning and rotation with cert-manager](https://developer.konghq.com/operator/dataplanes/how-to/cert-manager.md): Learn how to use cert-manager to provision TLS certificates for Kong Operator and rotate them without restarting Kong Gateway. - [Configure a plugin for a specific HTTPRoute](https://developer.konghq.com/operator/dataplanes/how-to/configure-plugins-for-httproute.md): Learn how to attach plugins to HTTPRoute resources using ExtensionRef or annotations. - [Configure load balancing with KongUpstreamPolicy](https://developer.konghq.com/operator/dataplanes/how-to/configure-upstream-policy.md): Learn how to customize load balancing behavior for a Kubernetes Service using the konghq.com/upstream-policy annotation and a KongUpstreamPolicy resource. - [Deploy custom plugins with Kong Operator](https://developer.konghq.com/operator/dataplanes/how-to/deploy-custom-plugins.md): Package and deploy custom Kong plugins as OCI images using the Kong Operator and reference them in Kong Gateway resources. - [Deploy sidecars](https://developer.konghq.com/operator/dataplanes/how-to/deploy-sidecars.md): Deploy sidecar containers alongside Kong Gateway using PodTemplateSpec - [Enable debug logging](https://developer.konghq.com/operator/dataplanes/how-to/enable-debug-logging.md): Enable debug logging for Kong Operator to troubleshoot issues. - [Validate Kafka message schemas with EventGatewaySchemaRegistry](https://developer.konghq.com/operator/dataplanes/how-to/event-gateway-schema-registry.md): Learn how to connect Kong Event Gateway to a schema registry and enforce schema validation on produced and consumed records. - [Proxy gRPC traffic using GRPCRoute](https://developer.konghq.com/operator/dataplanes/how-to/grpcroute.md): Learn how to configure GRPCRoute with Kong Operator to route gRPC traffic secured with TLS. - [Route traffic with a Kubernetes Ingress resource](https://developer.konghq.com/operator/dataplanes/how-to/handle-ingress.md): Configure Kong Operator to manage traditional Kubernetes Ingress resources. - [Manage Consumers and credentials with Kong Operator](https://developer.konghq.com/operator/dataplanes/how-to/manage-consumers.md): Learn how to create Consumers and manage credentials for authentication with Kong Operator. - [Deploy the private gateway](https://developer.konghq.com/operator/dataplanes/how-to/multi-tenancy/private-gateway.md): Create a Kong Gateway instance scoped to the private tenant namespace. - [Deploy the public gateway](https://developer.konghq.com/operator/dataplanes/how-to/multi-tenancy/public-gateway.md): Create a Kong Gateway instance scoped to the public tenant namespace. - [Install Kong Operator for multi-tenancy](https://developer.konghq.com/operator/dataplanes/how-to/multi-tenancy/setup.md): Create tenant namespaces, install Kong Operator scoped to those namespaces, and apply a KongLicense. - [Deploy test services](https://developer.konghq.com/operator/dataplanes/how-to/multi-tenancy/test-services.md): Deploy a backend service and HTTPRoute in each tenant namespace, then confirm that each gateway only serves its own routes. - [Preserve client IP addresses](https://developer.konghq.com/operator/dataplanes/how-to/preserve-client-ip.md): Learn how to configure Kong Operator to preserve the original client IP address using externalTrafficPolicy. - [Set DataPlane Image](https://developer.konghq.com/operator/dataplanes/how-to/set-dataplane-image.md): Customize the image used for Kong Gateway - [Set the Host header sent to a Service](https://developer.konghq.com/operator/dataplanes/how-to/set-host-header.md): Learn how to override the Host header that Kong Gateway sends to upstream services using the konghq.com/host-header annotation. - [Set timeouts and retries for a Service](https://developer.konghq.com/operator/dataplanes/how-to/set-timeouts-and-retries.md): Learn how to configure connection, read, and write timeouts and retry behavior on a Kubernetes Service using Kong Operator annotations. - [Split traffic between versions of a Service](https://developer.konghq.com/operator/dataplanes/how-to/split-traffic.md): Learn how to use the HTTPRoute resource to split traffic between multiples versions of the same Service. - [Proxy TCP traffic using TCPRoute](https://developer.konghq.com/operator/dataplanes/how-to/tcproute.md): Learn how to configure TCPRoute with Kong Operator to route raw TCP traffic by port. - [Proxy HTTPS traffic with TLS termination](https://developer.konghq.com/operator/dataplanes/how-to/tls-termination.md): Learn how to configure HTTPS listeners and TLS termination for Kong Operator. - [Proxy UDP traffic using UDPRoute](https://developer.konghq.com/operator/dataplanes/how-to/udproute.md): Learn how to configure UDPRoute with Kong Operator to route UDP traffic by port. - [Upgrade Kong Operator with Helm](https://developer.konghq.com/operator/dataplanes/how-to/upgrade-operator.md): Step-by-step instructions for upgrading Kong Operator with Helm, including the manual CRD steps Helm doesn't handle for you. - [Use a Custom CA Certificate](https://developer.konghq.com/operator/dataplanes/how-to/use-custom-ca-certificate.md): Use a custom CA certificate when generating Data Plane certificates for Konnect - [Add AI Consumers with Kong Operator](https://developer.konghq.com/operator/get-started/ai-gateway/consumers.md): Use AIGatewayConsumer, AIGatewayConsumerCredential, and AIGatewayConsumerGroup to authenticate downstream clients and enforce per-Consumer controls on your AI Gateway deployment. - [Deploy Kong AI Gateway with Kong Operator](https://developer.konghq.com/operator/get-started/ai-gateway/deploy.md): Create an AI Gateway control plane, configure an AI provider and model, and deploy the data plane in Kubernetes. - [Install Kong Operator for Kong AI Gateway](https://developer.konghq.com/operator/get-started/ai-gateway/install.md): Install Kong Operator with the AI Gateway data plane controller enabled and prepare a Kubernetes cluster for Kong AI Gateway. - [Apply AI Policies with Kong Operator](https://developer.konghq.com/operator/get-started/ai-gateway/policy.md): Add AIGatewayPolicy resources to enforce prompt guardrails and content governance on your AI Gateway deployment. - [Create a Dev Portal and publish content](https://developer.konghq.com/operator/get-started/dev-portal/create-portal.md): Create a `Portal`, a `PortalPage`, and a `PortalCustomization` with Kong Operator. - [Configure portal sign-in with OIDC](https://developer.konghq.com/operator/get-started/dev-portal/identity-provider.md): Configure a `PortalIdentityProviderRequest` for Dev Portal sign-in with Kong Operator. - [Install Kong Operator for Dev Portal](https://developer.konghq.com/operator/get-started/dev-portal/install.md): Install Kong Operator and prepare a Kubernetes cluster for Konnect Dev Portal CRDs. - [Configure portal settings](https://developer.konghq.com/operator/get-started/dev-portal/portal-settings.md): Configure email settings, team access, and a custom domain for a Dev Portal with Kong Operator. - [Install Kong Operator for Kong Event Gateway](https://developer.konghq.com/operator/get-started/event-gateway/install.md): Install Kong Operator and prepare a Kubernetes cluster for Kong Event Gateway. - [Deploy Kong Event Gateway with port mapping](https://developer.konghq.com/operator/get-started/event-gateway/port-mapping.md): Deploy Kong Event Gateway with a `LoadBalancer` Service and port-based broker mapping. - [Deploy Kong Event Gateway with TLSRoute and SNI](https://developer.konghq.com/operator/get-started/event-gateway/tlsroute-sni.md): Deploy Kong Event Gateway behind a Kubernetes Gateway using TLS passthrough and SNI routing. - [Configure route and service](https://developer.konghq.com/operator/get-started/gateway-api/create-route.md): Configure a Kong Gateway Service and Route using Kong Operator. - [Proxy TLS traffic by SNI using TLSRoute](https://developer.konghq.com/operator/get-started/gateway-api/create-tlsroute.md): Use TLSRoute with Kong Operator to route TCP traffic secured by TLS. - [Provision a Gateway](https://developer.konghq.com/operator/get-started/gateway-api/deploy-gateway.md): Provision a Hybrid Gateway in Konnect using the Gateway API. - [Install Kong Operator](https://developer.konghq.com/operator/get-started/gateway-api/install.md): Deploy the Kong Operator - [Create API Authentication](https://developer.konghq.com/operator/get-started/konnect-crds/authentication.md): Set up authentication between your Kubernetes cluster and Konnect using the `KonnectAPIAuthConfiguration` and `KonnectExtension` resources. - [Create a control plane](https://developer.konghq.com/operator/get-started/konnect-crds/controlplane.md): Define a Konnect Gateway control plane and bind it to your cluster using a `KonnectExtension`. - [Install Kong Operator](https://developer.konghq.com/operator/get-started/konnect-crds/install.md): Install the Kong Operator with Helm and enable Konnect CRD support. - [Enable Key Authentication](https://developer.konghq.com/operator/get-started/konnect-crds/key-authentication.md): Secure an API using the `key-auth` plugin and credentials from a `KongConsumer`. - [Enable Proxy Caching](https://developer.konghq.com/operator/get-started/konnect-crds/proxy-caching.md): Use the `KongPlugin` CRD to configure proxy caching for a route or service. - [Create a Service and Route](https://developer.konghq.com/operator/get-started/konnect-crds/service-and-route.md): Provision a service and route in Konnect using Kubernetes CRDs. - [Monitor Kong Gateway with Prometheus using direct scraping](https://developer.konghq.com/operator/how-to/observability/prometheus-direct-scraping.md): Learn how to enable and scrape Prometheus metrics from your data plane. - [Adopt existing entities from Konnect](https://developer.konghq.com/operator/konnect/crd/adoption/gateway.md): Manage existing gateway entities using Kubernetes CRDs in Konnect. - [Create a Cloud Gateway Data Plane group configuration](https://developer.konghq.com/operator/konnect/crd/cloud-gateways/configuration.md): Provision a Dedicated Cloud Gateway Data Plane group configuration in Konnect using the `KonnectCloudGatewayDataPlaneGroupConfiguration` CRD. - [Create a Cloud Gateway Network](https://developer.konghq.com/operator/konnect/crd/cloud-gateways/network.md): Provision a Dedicated Cloud Gateway Network in Konnect using the `KonnectCloudGatewayNetwork` CRD. - [Create a Control Plane Group](https://developer.konghq.com/operator/konnect/crd/control-planes/control-plane-group.md): Create a Control Plane, and a Control Plane Group that contains the Control Plane - [Create a control plane](https://developer.konghq.com/operator/konnect/crd/control-planes/hybrid.md): Create a Hybrid mode control plane in Konnect - [Create a Kong Ingress Controller Control Plane](https://developer.konghq.com/operator/konnect/crd/control-planes/kubernetes.md): Create a new Kong Ingress Controller Control Plane in Konnect - [Reference an existing Control Plane](https://developer.konghq.com/operator/konnect/crd/control-planes/mirror.md): Reference an existing Hybrid mode Control Plane in Konnect - [Deploy a data plane](https://developer.konghq.com/operator/konnect/crd/dataplane/hybrid.md): Deploy a data plane using Kong Operator. - [Create a Certificate and CA Certificate](https://developer.konghq.com/operator/konnect/crd/gateway/certificate-ca-cert.md): Provision TLS and CA certificates in Konnect using Kubernetes CRDs, and assign SNIs to TLS certificates. - [Create a Consumer and Consumer Group](https://developer.konghq.com/operator/konnect/crd/gateway/consumer.md): Provision Consumers and manage Consumer Groups in Konnect using Kubernetes CRDs. - [Create a Data Plane client certificate](https://developer.konghq.com/operator/konnect/crd/gateway/dataplane-certificate.md): Provision a Data Plane client certificate in Konnect using the `KongDataPlaneClientCertificate` CRD. - [Create a Key and Key Set](https://developer.konghq.com/operator/konnect/crd/gateway/key-keyset.md): Provision Keys and Key Sets in Konnect using CRDs, and associate Keys with Key Sets. - [Enable a plugin on a Route](https://developer.konghq.com/operator/konnect/crd/gateway/plugin.md): Enable a plugin on a Route in Konnect using the KongPlugin and KongPluginBinding CRDs and configure it for use with your control plane. - [Create a Service and Route](https://developer.konghq.com/operator/konnect/crd/gateway/service-and-route.md): Provision and manage Gateway Services and Routes in Konnect using KGO custom resources. - [Create a serviceless Route](https://developer.konghq.com/operator/konnect/crd/gateway/serviceless-route.md): Create a Kong Route that does not have an attached Service. Useful when used with the Lambda plugin. - [Create an Upstream and Target](https://developer.konghq.com/operator/konnect/crd/gateway/upstream-target.md): Provision an Upstream and attach Targets to it in Konnect using Kubernetes CRDs. - [Create a Vault](https://developer.konghq.com/operator/konnect/crd/gateway/vault.md): Provision a Vault in Konnect using the KongVault CRD and configure it for use with your Control Plane. - [Deploy a data plane](https://developer.konghq.com/operator/konnect/get-started/data-plane.md): Deploy a data plane using Kong Operator. - [Reference Konnect authentication across multiple namespaces with Kong Operator](https://developer.konghq.com/operator/konnect/how-to/auth-cross-namespace-reference.md): Learn how to use the KongReferenceGrant resource to use Konnect authentication configuration across namespaces. - [Store TLS certificate private keys in a Konnect Config Store](https://developer.konghq.com/operator/konnect/how-to/config-store-certificate-keys.md): Keep TLS private keys out of Kubernetes and out of your certificate objects by referencing them from a KonnectConfigStore-backed KongVault. - [Reference Secrets across multiple namespaces with Kong Operator](https://developer.konghq.com/operator/konnect/how-to/secret-cross-namespace-reference.md): Learn how to use the ReferenceGrant and KongReferenceGrant resources to reference a Secret across namespaces. - [Enable static naming for Konnect control planes with Kong Operator](https://developer.konghq.com/operator/konnect/how-to/static-naming.md): Ensure your Konnect control planes use predictable names to support references from other resources. - [Configure Basic Auth using Kong Gateway and Terraform](https://developer.konghq.com/terraform/how-to/gateway-authentication.md): Create a Control Plane, Service, Route, Consumer and Basic Auth plugin using Terraform ## API Gateway Plugins - [Access Control Enforcement Plugin](https://developer.konghq.com/plugins/ace.md): The ACE plugin manages developer access control to APIs published with Dev Portal. - [Access Control Enforcement Plugin Changelog](https://developer.konghq.com/plugins/ace/changelog.md): The ACE plugin manages developer access control to APIs published with Dev Portal. - [Access Control Enforcement: Only engage when a request matches an operation](https://developer.konghq.com/plugins/ace/examples/pass-through.md): The ACE plugin only engages with a request when it matches an operation. - [Access Control Enforcement: Require all requests to match operation](https://developer.konghq.com/plugins/ace/examples/require-match.md): Requires every incoming request to match a defined operation from an API or API package in Dev Portal. - [Access Control Enforcement: Multi-authentication](https://developer.konghq.com/plugins/ace/examples/skip-processing.md): Configures the anonymous Consumer to allow anonymous access or multi-authentication. - [Access Control Enforcement Plugin Configuration Reference](https://developer.konghq.com/plugins/ace/reference.md): The ACE plugin manages developer access control to APIs published with Dev Portal. - [ACL Plugin](https://developer.konghq.com/plugins/acl.md): Control which Consumers can access Services and Routes - [ACL Plugin OpenAPI Specification](https://developer.konghq.com/plugins/acl/api.md): Control which Consumers can access Services and Routes - [ACL Plugin Changelog](https://developer.konghq.com/plugins/acl/changelog.md): Control which Consumers can access Services and Routes - [ACL: Allow Consumer Groups](https://developer.konghq.com/plugins/acl/examples/allow-consumer-groups.md): Allows the dev and admin Consumers and Consumer Groups on the Service or Route that the ACL plugin is enabled on. - [ACL: Allow Consumers without appending the X-Consumer-Groups header](https://developer.konghq.com/plugins/acl/examples/allow-consumers.md): Allows the dev and admin Consumers on the Service or Route that the ACL plugin is enabled on. - [ACL: Allow by Principal metadata](https://developer.konghq.com/plugins/acl/examples/allow-when-principal-metadata.md): Allow requests using a CEL expression that reads the authenticated Principal's metadata, instead of a static allow list. - [ACL: Deny Consumer Groups](https://developer.konghq.com/plugins/acl/examples/deny-consumer-groups.md): Denies the dev and admin Consumers and Consumer Groups on the Service or Route that the ACL plugin is enabled on. - [ACL: Deny Consumers](https://developer.konghq.com/plugins/acl/examples/deny-consumers.md): Denies the dev and admin Consumers on the Service or Route that the ACL plugin is enabled on. - [ACL: Deny by Principal metadata](https://developer.konghq.com/plugins/acl/examples/deny-when-principal-metadata.md): Deny requests using a CEL expression that reads the authenticated Principal's metadata, instead of a static deny list. - [ACL Plugin Configuration Reference](https://developer.konghq.com/plugins/acl/reference.md): Control which Consumers can access Services and Routes - [ACME Plugin](https://developer.konghq.com/plugins/acme.md): Let's Encrypt and ACMEv2 integration with Kong Gateway - [ACME Plugin OpenAPI Specification](https://developer.konghq.com/plugins/acme/api.md): Let's Encrypt and ACMEv2 integration with Kong Gateway - [ACME Plugin Changelog](https://developer.konghq.com/plugins/acme/changelog.md): Let's Encrypt and ACMEv2 integration with Kong Gateway - [ACME: ACME with HashiCorp Consul storage](https://developer.konghq.com/plugins/acme/examples/consul.md): Configure the ACME plugin with HashiCorp Consul as the storage backend. - [ACME: ACME with Kong storage](https://developer.konghq.com/plugins/acme/examples/kong.md): Configure the ACME plugin with Kong Gateway as the storage backend. - [ACME: ACME with Redis storage and AWS ElastiCache instance auth](https://developer.konghq.com/plugins/acme/examples/redis-aws-instance.md): Configure the ACME plugin with Redis as a storage backend using AWS ElastiCache instance auth - [ACME: ACME with Redis storage and Azure Managed Redis instance auth](https://developer.konghq.com/plugins/acme/examples/redis-azure-instance.md): Configure the ACME plugin with Redis as a storage backend using Azure Managed Redis instance auth - [ACME: ACME with Redis storage and Google Cloud Memorystore instance auth](https://developer.konghq.com/plugins/acme/examples/redis-gcp-instance.md): Configure the ACME plugin with Redis as a storage backend using Google Cloud Memorystore instance auth - [ACME: ACME with Redis storage](https://developer.konghq.com/plugins/acme/examples/redis.md): Configure the ACME plugin with Redis as a storage backend. - [ACME: ACME with shm storage](https://developer.konghq.com/plugins/acme/examples/shm.md): Configure the ACME plugin with a Lua shared dict as the storage backend. - [ACME: ACME with HashiCorp Vault storage](https://developer.konghq.com/plugins/acme/examples/vault.md): Configure the ACME plugin with HashiCorp Vault as the storage backend. - [ACME Plugin Configuration Reference](https://developer.konghq.com/plugins/acme/reference.md): Let's Encrypt and ACMEv2 integration with Kong Gateway - [AI A2A Proxy Plugin](https://developer.konghq.com/plugins/ai-a2a-proxy.md): Provide observability and gateway control for Agent-to-Agent (A2A) protocol traffic, supporting both JSON-RPC and REST bindings - [AI A2A Proxy Plugin Changelog](https://developer.konghq.com/plugins/ai-a2a-proxy/changelog.md): Provide observability and gateway control for Agent-to-Agent (A2A) protocol traffic, supporting both JSON-RPC and REST bindings - [AI A2A Proxy: Enable observability for an A2A agent](https://developer.konghq.com/plugins/ai-a2a-proxy/examples/enable-observability-for-a2a-agent.md): Enable statistics and payload logging for Agent-to-Agent (A2A) protocol traffic proxied through Kong Gateway. - [AI A2A Proxy Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-a2a-proxy/reference.md): Provide observability and gateway control for Agent-to-Agent (A2A) protocol traffic, supporting both JSON-RPC and REST bindings - [AI AWS Guardrails Plugin](https://developer.konghq.com/plugins/ai-aws-guardrails.md): Use AWS Guardrails to validate requests and/or responses in the AI Proxy plugin before forwarding them between clients and upstream LLMs. - [AI AWS Guardrails Plugin Changelog](https://developer.konghq.com/plugins/ai-aws-guardrails/changelog.md): Use AWS Guardrails to validate requests and/or responses in the AI Proxy plugin before forwarding them between clients and upstream LLMs. - [AI AWS Guardrails: Block requests or responses that violates guardrails policies](https://developer.konghq.com/plugins/ai-aws-guardrails/examples/block-requests-that-violate.guardaril-policies.md): Configure the AI AWS Guardrails plugin to block requests or responses that violates guardrails policies predefined on AWS. - [AI AWS Guardrails: Log blocked request and response content](https://developer.konghq.com/plugins/ai-aws-guardrails/examples/log-blocked-content.md): Configure the AI AWS Guardrails plugin to log the raw content of blocked requests and responses. When a request or response is blocked, the original prompt or response body is captured in the Kong Gateway logs under `ai.proxy.aws-guardrails.input_faulty_prompt` and `ai.proxy.aws-guardrails.output_faulty_response`. - [AI AWS Guardrails: Use IAM role assumption](https://developer.konghq.com/plugins/ai-aws-guardrails/examples/use-iam-role.md): Configure the AI AWS Guardrails plugin to use IAM role assumption instead of static credentials. - [AI AWS Guardrails Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-aws-guardrails/reference.md): Use AWS Guardrails to validate requests and/or responses in the AI Proxy plugin before forwarding them between clients and upstream LLMs. - [AI Azure Content Safety Plugin](https://developer.konghq.com/plugins/ai-azure-content-safety.md): Use Azure AI Content Safety to check and audit AI Proxy plugin messages before proxying them to an upstream LLM - [AI Azure Content Safety Plugin Changelog](https://developer.konghq.com/plugins/ai-azure-content-safety/changelog.md): Use Azure AI Content Safety to check and audit AI Proxy plugin messages before proxying them to an upstream LLM - [AI Azure Content Safety: Block request content in predefined categories](https://developer.konghq.com/plugins/ai-azure-content-safety/examples/block-predefined-categories.md): Configure the AI Azure Content Safety plugin to check requests and block content matching harm categories defined by Azure. - [AI Azure Content Safety: Log blocked request and response content](https://developer.konghq.com/plugins/ai-azure-content-safety/examples/log-blocked-content.md): Configure the AI Azure Content Safety plugin to log the raw content of blocked requests and responses. When a request or response is blocked, the original prompt or response body is captured in the Kong Gateway logs under `ai.proxy.azure-content-safety.input_faulty_prompt` and `ai.proxy.azure-content-safety.output_faulty_response`. - [AI Azure Content Safety: Block request and response content in predefined categories](https://developer.konghq.com/plugins/ai-azure-content-safety/examples/moderate-requests-and-responses.md): Configure the AI Azure Content Safety plugin to check requests and responses, and block content matching harm categories defined by Azure. - [AI Azure Content Safety: Block response content in predefined categories](https://developer.konghq.com/plugins/ai-azure-content-safety/examples/moderate-responses.md): Configure the AI Azure Content Safety plugin to check responses and block content matching harm categories defined by Azure. - [AI Azure Content Safety Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-azure-content-safety/reference.md): Use Azure AI Content Safety to check and audit AI Proxy plugin messages before proxying them to an upstream LLM - [AI Custom Guardrail Plugin](https://developer.konghq.com/plugins/ai-custom-guardrail.md): Use a third-party guardrails service to validate requests and/or responses in the AI Proxy plugin before forwarding them between clients and upstream LLMs - [AI Custom Guardrail Plugin Changelog](https://developer.konghq.com/plugins/ai-custom-guardrail/changelog.md): Use a third-party guardrails service to validate requests and/or responses in the AI Proxy plugin before forwarding them between clients and upstream LLMs - [AI Custom Guardrail: Block request and response content using Azure Content Safety](https://developer.konghq.com/plugins/ai-custom-guardrail/examples/azure-content-safety.md): Configure the AI Custom Guardrail plugin to check requests and responses, and block content matching harm categories defined by Azure. - [AI Custom Guardrail: Block request and response content using Mistral AI moderation](https://developer.konghq.com/plugins/ai-custom-guardrail/examples/mistral-moderation.md): Configure the AI Custom Guardrail plugin to check requests and responses, and block content matching using Mistral AI. - [AI Custom Guardrail Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-custom-guardrail/reference.md): Use a third-party guardrails service to validate requests and/or responses in the AI Proxy plugin before forwarding them between clients and upstream LLMs - [AI GCP Model Armor Plugin](https://developer.konghq.com/plugins/ai-gcp-model-armor.md): Audit and validate LLM prompts with Google Cloud Model Armor before forwarding them to an upstream LLM. - [AI GCP Model Armor Plugin Changelog](https://developer.konghq.com/plugins/ai-gcp-model-armor/changelog.md): Audit and validate LLM prompts with Google Cloud Model Armor before forwarding them to an upstream LLM. - [AI GCP Model Armor: AI GCP Model Armor configuration](https://developer.konghq.com/plugins/ai-gcp-model-armor/examples/configure-gcp-model-armor.md): Configuration for enforcing content safety policies on LLM requests and responses using GCP Model Armor. - [AI GCP Model Armor: Log blocked request and response content](https://developer.konghq.com/plugins/ai-gcp-model-armor/examples/log-blocked-content.md): Configure the AI GCP Model Armor plugin to log the raw content of blocked requests and responses. When a request or response is blocked, the original prompt or response body is captured in the Kong Gateway logs under `ai.proxy.gcp-model-armor.input_faulty_prompt` and `ai.proxy.gcp-model-armor.output_faulty_response`. - [AI GCP Model Armor Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-gcp-model-armor/reference.md): Audit and validate LLM prompts with Google Cloud Model Armor before forwarding them to an upstream LLM. - [AI Lakera Guard Plugin](https://developer.konghq.com/plugins/ai-lakera-guard.md): Inspect and enforce Lakera Guard safety policies on LLM requests and responses before they reach upstream models. - [AI Lakera Guard Plugin Changelog](https://developer.konghq.com/plugins/ai-lakera-guard/changelog.md): Inspect and enforce Lakera Guard safety policies on LLM requests and responses before they reach upstream models. - [AI Lakera Guard: Inspect requests only with ai-lakera-guard to inspect responses](https://developer.konghq.com/plugins/ai-lakera-guard/examples/configure-lakera-to-reveal-the-failure-reason-to-clients.md): Configure the AI Lakera Guard plugin to reveal or conceal the failure reason to clients. - [AI Lakera Guard: Configure the AI Lakera Guard plugin to inspect reponses](https://developer.konghq.com/plugins/ai-lakera-guard/examples/inspect-requests-only.md): Configure the AI Lakera Guard plugin to inspect reponses. - [AI Lakera Guard: Log blocked request and response content](https://developer.konghq.com/plugins/ai-lakera-guard/examples/log-blocked-content.md): Configure the AI Lakera Guard plugin to log the raw content of blocked requests and responses. When a request or response is blocked, the original prompt or response body is captured in the Kong Gateway logs under `ai.proxy.lakera-guard.input_faulty_prompt` and `ai.proxy.lakera-guard.output_faulty_response`. - [AI Lakera Guard: Use the Lakera self-hosted instead of the cloud-hosted SaaS](https://developer.konghq.com/plugins/ai-lakera-guard/examples/use-the-lakera-self-hosted-instead-of-cloud-hosted-saas.md): Use the Lakera self-hosted instead of the cloud-hosted SaaS. - [AI Lakera Guard Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-lakera-guard/reference.md): Inspect and enforce Lakera Guard safety policies on LLM requests and responses before they reach upstream models. - [AI LLM as Judge Plugin](https://developer.konghq.com/plugins/ai-llm-as-judge.md): Evaluate and optimize your Large Language Models with accuracy - [AI LLM as Judge Plugin Changelog](https://developer.konghq.com/plugins/ai-llm-as-judge/changelog.md): Evaluate and optimize your Large Language Models with accuracy - [AI LLM as Judge: Configure the AI LLM as Judge plugin](https://developer.konghq.com/plugins/ai-llm-as-judge/examples/configure-ai-llm-as-judge-plugin.md): Evaluate responses by assigning a correctness score for AI-assisted learning and assessment. - [AI LLM as Judge Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-llm-as-judge/reference.md): Evaluate and optimize your Large Language Models with accuracy - [AI MCP OAuth2 Plugin](https://developer.konghq.com/plugins/ai-mcp-oauth2.md): Secure MCP server access with OAuth2 authentication - [AI MCP OAuth2 Plugin Changelog](https://developer.konghq.com/plugins/ai-mcp-oauth2/changelog.md): Secure MCP server access with OAuth2 authentication - [AI MCP OAuth2: Configure the AI MCP Oauth2 plugin](https://developer.konghq.com/plugins/ai-mcp-oauth2/examples/configure-the-ai-mcp-oauth2-plugin.md): Configure the AI MCP Oauth2 plugin - [AI MCP OAuth2: Consumer and consumer group mapping](https://developer.konghq.com/plugins/ai-mcp-oauth2/examples/consumer-mapping.md): Map OAuth2 token claims to Kong consumers and consumer groups - [AI MCP OAuth2: Forward nested token claims as upstream headers](https://developer.konghq.com/plugins/ai-mcp-oauth2/examples/nested-claim-headers.md): Use `upstream_headers` to map nested token claims to HTTP headers sent to the upstream MCP server - [AI MCP OAuth2: Token exchange](https://developer.konghq.com/plugins/ai-mcp-oauth2/examples/token-exchange.md): Swap the client access token for a different token before forwarding to the upstream MCP server - [AI MCP OAuth2 Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-mcp-oauth2/reference.md): Secure MCP server access with OAuth2 authentication - [AI MCP Proxy Plugin](https://developer.konghq.com/plugins/ai-mcp-proxy.md): Convert APIs into MCP tools, proxy MCP servers, expose multiple MCP tools for AI clients, and observe MCP traffic in real time. - [AI MCP Proxy Plugin Changelog](https://developer.konghq.com/plugins/ai-mcp-proxy/changelog.md): Convert APIs into MCP tools, proxy MCP servers, expose multiple MCP tools for AI clients, and observe MCP traffic in real time. - [AI MCP Proxy: Set access control rules for MCP tools based on consumer groups](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/conversion-listener-acl.md): Set access control rules for MCP tools by consumer group - [AI MCP Proxy: Generate an MCP server in conversion-listener mode with cookie conversion](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/conversion-listener-cookie.md): Generate an MCP server from Kong Gateway Service with cookie conversion - [AI MCP Proxy: Configure consumer groups and key authentication for per-tool MCP access control](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/conversion-listener-tool-acls.md): Set up consumer groups and key authentication for MCP tool access control - [AI MCP Proxy: Generate an MCP server in conversion-listener mode](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/conversion-listener.md): Generate an MCP server from Kong Gateway Service - [AI MCP Proxy: Define reusable MCP tool specifications without serving them.](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/conversion-only.md): Define reusable MCP tool specifications without serving them. - [AI MCP Proxy: Aggregate MCP tools from conversion-only mode plugins](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/listener.md): Aggregate MCP tools from conversion-only mode plugins - [AI MCP Proxy: Configure default and per-tool access control for passthrough-listener mode MCP servers](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/passthrough-listener-acls.md): Set access control rules for passthrough-listener mode MCP servers - [AI MCP Proxy: Configure per-tool access control for passthrough-listener mode MCP servers](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/passthrough-listener-tool-acls.md): Set per-tool access control for passthrough-listener mode MCP servers - [AI MCP Proxy: Configure AI Gateway passthrough for existing MCP Servers](https://developer.konghq.com/plugins/ai-mcp-proxy/examples/passthrough-listener.md): Configure AI Gateway passthrough for existing MCP Servers - [AI MCP Proxy Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-mcp-proxy/reference.md): Convert APIs into MCP tools, proxy MCP servers, expose multiple MCP tools for AI clients, and observe MCP traffic in real time. - [AI Prompt Compressor Plugin](https://developer.konghq.com/plugins/ai-prompt-compressor.md): Compress prompts before they are sent to LLMs to reduce costs, and improve latency - [AI Prompt Compressor Plugin OpenAPI Specification](https://developer.konghq.com/plugins/ai-prompt-compressor/api.md): Compress prompts before they are sent to LLMs to reduce costs, and improve latency - [AI Prompt Compressor Plugin Changelog](https://developer.konghq.com/plugins/ai-prompt-compressor/changelog.md): Compress prompts before they are sent to LLMs to reduce costs, and improve latency - [AI Prompt Compressor: Configure the AI Prompt Compressor plugin](https://developer.konghq.com/plugins/ai-prompt-compressor/examples/example.md): Configure the AI Prompt Compressor plugin - [AI Prompt Compressor Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-prompt-compressor/reference.md): Compress prompts before they are sent to LLMs to reduce costs, and improve latency - [AI Prompt Decorator Plugin](https://developer.konghq.com/plugins/ai-prompt-decorator.md): Prepend or append an array of llm/v1/chat messages to a user's chat history - [AI Prompt Decorator Plugin Changelog](https://developer.konghq.com/plugins/ai-prompt-decorator/changelog.md): Prepend or append an array of llm/v1/chat messages to a user's chat history - [AI Prompt Decorator: Create a complex chat history](https://developer.konghq.com/plugins/ai-prompt-decorator/examples/create-a-complex-chat-history.md): Creates a detailed chat history by configuring the plugin to prepend and append multiple messages, allowing any user to continue the conversation. - [AI Prompt Decorator: Engineer a prompt with prepending](https://developer.konghq.com/plugins/ai-prompt-decorator/examples/engineer-a-prompt.md): Prepends a prompt with specific instructions, such as responding in French, to control how the prompt responds. - [AI Prompt Decorator Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-prompt-decorator/reference.md): Prepend or append an array of llm/v1/chat messages to a user's chat history - [AI Prompt Guard Plugin](https://developer.konghq.com/plugins/ai-prompt-guard.md): Check text completion requests against a list of allowed or denied expressions - [AI Prompt Guard Plugin Changelog](https://developer.konghq.com/plugins/ai-prompt-guard/changelog.md): Check text completion requests against a list of allowed or denied expressions - [AI Prompt Guard: Allow and deny](https://developer.konghq.com/plugins/ai-prompt-guard/examples/allow-and-deny.md): Use the AI Prompt Guard plugin to allow general IT questions and block prompts related to hacking, phishing, or inappropriate use. - [AI Prompt Guard: Allow only](https://developer.konghq.com/plugins/ai-prompt-guard/examples/allow-only.md): Configure the AI Prompt Guard plugin to allow messages following a specific pattern. - [AI Prompt Guard: Deny only](https://developer.konghq.com/plugins/ai-prompt-guard/examples/deny-only.md): Configure the AI Prompt Guard plugin to deny messages following a specific pattern. - [AI Prompt Guard Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-prompt-guard/reference.md): Check text completion requests against a list of allowed or denied expressions - [AI Prompt Template Plugin](https://developer.konghq.com/plugins/ai-prompt-template.md): Provide fill-in-the-blank AI prompts to users - [AI Prompt Template Plugin Changelog](https://developer.konghq.com/plugins/ai-prompt-template/changelog.md): Provide fill-in-the-blank AI prompts to users - [AI Prompt Template: Block untemplated requests](https://developer.konghq.com/plugins/ai-prompt-template/examples/block-untemplated-requests.md): Configure the AI Prompt Template plugin with a template and block any requests that don't include a template. - [AI Prompt Template: Chat route templates](https://developer.konghq.com/plugins/ai-prompt-template/examples/chat-route-templates.md): Configure the AI Prompt Template plugin with two templates to use for chat routes. - [AI Prompt Template: Completion route template](https://developer.konghq.com/plugins/ai-prompt-template/examples/completions-route-template.md): Configure the AI Prompt Template plugin with a template to use for completions routes. - [AI Prompt Template Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-prompt-template/reference.md): Provide fill-in-the-blank AI prompts to users - [AI Proxy Advanced Plugin](https://developer.konghq.com/plugins/ai-proxy-advanced.md): The AI Proxy Advanced plugin lets you transform and proxy requests to multiple AI providers and models at the same time. This lets you set up load balancing between targets. - [AI Proxy Advanced Plugin Changelog](https://developer.konghq.com/plugins/ai-proxy-advanced/changelog.md): The AI Proxy Advanced plugin lets you transform and proxy requests to multiple AI providers and models at the same time. This lets you set up load balancing between targets. - [AI Proxy Advanced: Chat route with Anthropic](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/anthropic-chat-route.md): Configure a chat route using Anthropic with the latest Claude 3.5 Sonnet model and version 2023-06-01 of the Anthropic API. - [AI Proxy Advanced: Assistants chat route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/assistants-route-type.md): Use the Assistants API to create a persistent, tool-augmented agent backed by GPT-4. - [AI Proxy Advanced: Text-to-Speech (TTS) route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/audio-speech-openai.md): Set up an audio speech synthesis route using OpenAI’s text-to-speech model. - [AI Proxy Advanced: Audio transcription route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/audio-transcription-openai.md): Configure an audio transcription route using the Whisper model. - [AI Proxy Advanced: Audio translation route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/audio-translation-openai.md): Set up an audio speech translation route using OpenAI’s text-to-speech model. - [AI Proxy Advanced: Authenticate to Azure OpenAI Service with an Azure Managed Identity](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/azure-ai-with-managed-identity.md): Configure a chat route using Azure OpenAI Service with the latest GPT-4o model, and authenticate using an Azure Managed Identity. - [AI Proxy Advanced: Batches route with Azure OpenAI Service](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/azure-batches-route.md): Configure a batch route using Azure OpenAI Service. - [AI Proxy Advanced: Chat route with Azure OpenAI Service](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/azure-chat-route.md): Configure a chat route using Azure OpenAI Service with the GPT-4o model. - [AI Proxy Advanced: Files route with Azure OpenAI Service](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/azure-files-route.md): Configure a files route using Azure OpenAI Service. - [AI Proxy Advanced: Batches route type](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/batches-route-type.md): Create large batches of API requests for asynchronous processing. - [AI Proxy Advanced: Chat route with Amazon Bedrock](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/bedrock-chat-route.md): Configure a chat route using Amazon Bedrock with the Meta Llama 3 70B Instruct model and the US East 1 AWS region. - [AI Proxy Advanced: Native Amazon Bedrock API route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/bedrock-native-routes.md): Use the AWS SDK with native Amazon Bedrock APIs through AI Proxy Advanced. - [AI Proxy Advanced: Chat route with Cerebras](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/cerebras-chat-route.md): Configure a chat route using Cerebras with the gpt-oss-120b model. - [AI Proxy Advanced: Health check and circuit breaker](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/circuit-breaker.md): Configure the plugin to circuit-break a target when it's considered unhealthy. - [AI Proxy Advanced: Configure AI Proxy Advanced for Claude Code with Anthropic](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-anthropic.md): Set up the AI Proxy Advanced plugin to work with Claude Code, using Anthropic as the LLM provider. - [AI Proxy Advanced: Configure AI Proxy for Claude Code with Azure OpenAI](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-azure.md): Set up the AI Proxy plugin to work with Claude Code, using Azure OpenAI as the LLM provider with GPT-4.1 model. - [AI Proxy Advanced: Configure AI Proxy for Claude Code with AWS Bedrock](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-bedrock.md): Set up the AI Proxy plugin to work with Claude Code, using AWS Bedrock with Claude Haiku 4.5 model. - [AI Proxy Advanced: Configure AI Proxy Advanced for Claude Code with DashScope](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-dashscope.md): Set up the AI Proxy Advanced plugin to work with Claude Code, using Alibaba Cloud DashScope as the LLM provider. - [AI Proxy Advanced: Configure AI Proxy for Claude Code with Google Gemini](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-gemini.md): Set up the AI Proxy plugin to work with Claude Code, using Google Gemini 2.0 Flash with GCP service account authentication. - [AI Proxy Advanced: Configure AI Proxy Advanced for Claude Code with HuggingFace](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-huggingface.md): Set up the AI Proxy Advanced plugin to work with Claude Code, using HuggingFace Inference API as the LLM provider. - [AI Proxy Advanced: Configure AI Proxy Advanced for Claude Code with OpenAI](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-openai.md): Set up the AI Proxy plugin to work with Claude Code, using OpenAI as the LLM provider. - [AI Proxy Advanced: Configure AI Proxy for Claude Code with Google Vertex AI](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/claude-code-vertex.md): Set up the AI Proxy plugin to work with Claude Code, using Google Vertex AI with Gemini 2.5 Flash model. - [AI Proxy Advanced: Chat route with Cohere](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/cohere-chat-route.md): Configure a chat route using the Cohere command model. - [AI Proxy Advanced: Native Cohere API route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/cohere-native-routes.md): Use the Cohere SDK with native APIs through AI Proxy. - [AI Proxy Advanced: Load balancing: Consistent-hashing](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/consistent-hashing.md): Configure the plugin to use two OpenAI models and route requests based on the custom X-Hashing-Header header. - [AI Proxy Advanced: Chat route with DashScope](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/dashscope-chat-route.md): Configure a chat route using Alibaba Cloud's DashScope Qwen Plus model. - [AI Proxy Advanced: Chat route with Databricks](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/databricks-chat-route.md): Configure a chat route using the Databricks GPT OSS 20B model. - [AI Proxy Advanced: Chat route with DeepSeek](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/deepseek-chat-route.md): Configure a chat route using the DeepSeek Chat model. - [AI Proxy Advanced: Embeddings route type](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/embeddings-route-type.md): Access the embeddings endpoint to generate text embeddings using OpenAI’s text-embedding-3-large model. Use this route for embedding-based semantic search, similarity, or other vector-based AI features. - [AI Proxy Advanced: Files route type](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/files-route-type.md): Upload documents via the files route to use with OpenAI features like Assistants or and Batch API. - [AI Proxy Advanced: Chat route with Gemini](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/gemini-chat-route.md): Configure a chat route using the Gemini 1.5 Flash model. - [AI Proxy Advanced: Native Gemini API route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/gemini-native-routes.md): Use the Gemini SDK with native Gemini APIs through AI Proxy Advanced. - [AI Proxy Advanced: Native Hugging Face API route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/hugging-face-native-routes.md): Use the Hugging Face SDK with native APIs through AI Proxy Advanced. - [AI Proxy Advanced: Chat route with Hugging Face](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/huggingface-chat-route.md): Configure a chat route using Hugging Face with the SmolLM model. - [AI Proxy Advanced: Image editing route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/image-edits-openai.md): Configure an image editing route using OpenAI’s GPT Image 1.5 model. - [AI Proxy Advanced: Image generation route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/image-generation-openai.md): Configure an image generation route using OpenAI’s GPT Image 1.5 model. - [AI Proxy Advanced: Load balancing: Least-connections](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/least-connections.md): Configure the plugin to use two OpenAI models and route requests based on in-flight connection counts and spare capacity. - [AI Proxy Advanced: Chat route with Llama 2](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/llama2-chat-route.md): Configure a chat route using a local Llama 2 model with the OLLAMA format. - [AI Proxy Advanced: Load balancing: Lowest-latency](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/lowest-latency.md): Configure the plugin to use two OpenAI models and route requests based on end-to-end response time. - [AI Proxy Advanced: Load balancing: Lowest-usage](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/lowest-usage.md): Configure the plugin to use two OpenAI models and route requests based on the number of tokens in the prompt. - [AI Proxy Advanced: Chat route with Mistral](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/mistral-chat-route.md): Configure a chat route using the Mistral Tiny model with the OpenAI format. - [AI Proxy Advanced: Route by model alias](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/model-alias-routing.md): Route requests to different OpenAI models based on the model field in the request body using model aliases. - [AI Proxy Advanced: Chat route with Ollama](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/ollama-chat-route.md): Configure a chat route using a local Qwen 3 model. - [AI Proxy Advanced: Chat route with OpenAI](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/openai-chat-route.md): Configure a chat route using the OpenAI GPT-4 model. - [AI Proxy Advanced: Load balancing: Priority](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/priority.md): Configure the plugin to use three OpenAI models and create priority groups based on their respective weights. - [AI Proxy Advanced: Realtime generation route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/realtime-route-openai.md): Configure a realtime generation route for streaming responses using OpenAI model. - [AI Proxy Advanced: Responses route type](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/responses-route-type.md): Use the Responses API to fetch metadata about past OpenAI requests for debugging and analysis. - [AI Proxy Advanced: Load balancing: Round-robin](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/round-robin.md): Configure the plugin to use three OpenAI models and route requests based on their respective weights. - [AI Proxy Advanced: OpenAI SDK: One chat route with dynamic Azure OpenAI deployments](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/sdk-azure-one-route.md): Configure a dynamic route to target multiple Azure OpenAI model deployments. - [AI Proxy Advanced: OpenAI SDK: Chat route with dynamic model selection](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/sdk-dynamic-model-selection.md): Configure a chat route that reads the target model from the request path instead of hardcoding it in the configuration. - [AI Proxy Advanced: OpenAI SDK: Multi-deployment chat routing](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/sdk-multiple-azure-deployments.md): Use separate Routes to map Azure OpenAI SDK requests to specific deployments of GPT-4o and GPT-4-1-mini. - [AI Proxy Advanced: OpenAI SDK: Multi-provider chat routing](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/sdk-two-routes.md): Use a single OpenAI SDK client to route chat requests to different LLM providers by defining separate Routes per provider. - [AI Proxy Advanced: Load balancing: Semantic with Valkey](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/semantic-valkey.md): Configure semantic load balancing with the AI Proxy Advanced plugin using Valkey as a vector database - [AI Proxy Advanced: Load balancing: Semantic with fallback](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/semantic-with-fallback.md): Configure the plugin to route requests based on semantic similarity between prompts and model descriptions, with automatic fallback among models sharing identical descriptions. - [AI Proxy Advanced: Load balancing: Semantic](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/semantic.md): Configure semantic load balancing with the AI Proxy Advanced plugin - [AI Proxy Advanced: Video generation route](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/video-generation-openai.md): Configure a video generation route using OpenAI Sora 2 model. - [AI Proxy Advanced: Chat route with vLLM](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/vllm-chat-route.md): Configure a chat route using a self-hosted vLLM server. - [AI Proxy Advanced: Chat route with xAI](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/xai-chat-route.md): Configure a chat route using the xAI Grok 4 model. - [AI Proxy Advanced: Image generation with xAI](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/xai-image-generation.md): Configure an image generation route with the xAI Grok 2 Image Gen model. - [AI Proxy Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-proxy-advanced/reference.md): The AI Proxy Advanced plugin lets you transform and proxy requests to multiple AI providers and models at the same time. This lets you set up load balancing between targets. - [AI Proxy Plugin](https://developer.konghq.com/plugins/ai-proxy.md): The AI Proxy plugin lets you transform and proxy requests to a number of AI providers and models. - [AI Proxy Plugin Changelog](https://developer.konghq.com/plugins/ai-proxy/changelog.md): The AI Proxy plugin lets you transform and proxy requests to a number of AI providers and models. - [AI Proxy: Chat route with Anthropic](https://developer.konghq.com/plugins/ai-proxy/examples/anthropic-chat-route.md): Configure a chat route using Anthropic with the latest Claude Sonnet model and version 2023-06-01 of the Anthropic API. - [AI Proxy: Assistants chat route](https://developer.konghq.com/plugins/ai-proxy/examples/assistants-route-type.md): Use the Assistants API to create a persistent, tool-augmented agent backed by GPT-4. - [AI Proxy: Text-to-Speech (TTS) route](https://developer.konghq.com/plugins/ai-proxy/examples/audio-speech-openai.md): Set up an audio speech synthesis route using OpenAI’s text-to-speech model. - [AI Proxy: Audio transcription route](https://developer.konghq.com/plugins/ai-proxy/examples/audio-transcription-openai.md): Configure an audio transcription route using OpenAI’s Whisper model. - [AI Proxy: Audio translation route](https://developer.konghq.com/plugins/ai-proxy/examples/audio-translation-openai.md): Set up an audio speech translation route using OpenAI’s text-to-speech model. - [AI Proxy: Authenticate to Azure OpenAI Service with an Azure Managed Identity](https://developer.konghq.com/plugins/ai-proxy/examples/azure-ai-with-managed-identity.md): Configure a chat route using Azure OpenAI Service with the latest GPT-4o model, and authenticate using an Azure Managed Identity. - [AI Proxy: Batches route with Azure OpenAI Service](https://developer.konghq.com/plugins/ai-proxy/examples/azure-batches-route.md): Configure a batch route using Azure OpenAI Service. - [AI Proxy: Chat route with Azure OpenAI Service](https://developer.konghq.com/plugins/ai-proxy/examples/azure-chat-route.md): Configure a chat route using Azure OpenAI Service with the GPT-4o model. - [AI Proxy: Files route with Azure OpenAI Service](https://developer.konghq.com/plugins/ai-proxy/examples/azure-files-route.md): Configure a files route using Azure OpenAI Service. - [AI Proxy: Batches route type](https://developer.konghq.com/plugins/ai-proxy/examples/batches-route-type.md): Create large batches of API requests for asynchronous processing. - [AI Proxy: Chat route with Amazon Bedrock](https://developer.konghq.com/plugins/ai-proxy/examples/bedrock-chat-route.md): Configure a chat route using Amazon Bedrock with the Meta Llama 3 70B Instruct model and the US East 1 AWS region. - [AI Proxy: Native Amazon Bedrock API route](https://developer.konghq.com/plugins/ai-proxy/examples/bedrock-native-routes.md): Use the AWS SDK with native Amazon Bedrock APIs through AI Proxy. - [AI Proxy: Chat route with Cerebras](https://developer.konghq.com/plugins/ai-proxy/examples/cerebras-chat-route.md): Configure a chat route using Cerebras with the gpt-oss-120b model. - [AI Proxy: Configure AI Proxy for Claude Code with Anthropic](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-anthropic.md): Set up the AI Proxy plugin to work with Claude Code, using Anthropic as the LLM provider. - [AI Proxy: Configure AI Proxy for Claude Code with Azure OpenAI](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-azure.md): Set up the AI Proxy plugin to work with Claude Code, using Azure OpenAI as the LLM provider with GPT-4.1 model. - [AI Proxy: Configure AI Proxy for Claude Code with AWS Bedrock](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-bedrock.md): Set up the AI Proxy plugin to work with Claude Code, using AWS Bedrock with Claude Haiku 4.5 and API version bedrock-2023-05-31. - [AI Proxy: Configure AI Proxy for Claude Code with DashScope (Alibaba Cloud)](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-dashscope.md): Set up the AI Proxy plugin to work with Claude Code, using Alibaba Cloud DashScope as the LLM provider with Qwen models. - [AI Proxy: Configure AI Proxy for Claude Code with Google Gemini](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-gemini.md): Set up the AI Proxy plugin to work with Claude Code, using Google Gemini 2.0 Flash with GCP service account authentication. - [AI Proxy: Configure AI Proxy for Claude Code with HuggingFace](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-huggingface.md): Set up the AI Proxy plugin to work with Claude Code, using HuggingFace Inference API as the LLM provider with Llama models. - [AI Proxy: Configure AI Proxy for Claude Code with OpenAI](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-openai.md): Set up the AI Proxy plugin to work with Claude Code, using OpenAI as the LLM provider. - [AI Proxy: Configure AI Proxy for Claude Code with Google Vertex AI](https://developer.konghq.com/plugins/ai-proxy/examples/claude-code-vertex.md): Set up the AI Proxy plugin to work with Claude Code, using Google Vertex AI with Gemini 2.5 Flash model. - [AI Proxy: Chat route with Cohere](https://developer.konghq.com/plugins/ai-proxy/examples/cohere-chat-route.md): Configure a chat route using the Cohere command model. - [AI Proxy: Native Cohere API route](https://developer.konghq.com/plugins/ai-proxy/examples/cohere-native-routes.md): Use the Cohere SDK with native APIs through AI Proxy. - [AI Proxy: Chat route with DashScope](https://developer.konghq.com/plugins/ai-proxy/examples/dashscope-chat-route.md): Configure a chat route using Alibaba Cloud's DashScope Qwen Plus model. - [AI Proxy: Chat route with Databricks](https://developer.konghq.com/plugins/ai-proxy/examples/databricks-chat-route.md): Configure a chat route using the Databricks GPT OSS 20B model. - [AI Proxy: Chat route with DeepSeek](https://developer.konghq.com/plugins/ai-proxy/examples/deepseek-chat-route.md): Configure a chat route using the DeepSeek Chat model. - [AI Proxy: Embeddings route type](https://developer.konghq.com/plugins/ai-proxy/examples/embeddings-route-type.md): Access the embeddings endpoint to generate text embeddings using OpenAI’s text-embedding-3-large model. Use this route for embedding-based semantic search, similarity, or other vector-based AI features. - [AI Proxy: Files route type](https://developer.konghq.com/plugins/ai-proxy/examples/files-route-type.md): Upload documents via the files route to use with OpenAI features like Assistants or and Batch API. - [AI Proxy: Chat route with Gemini](https://developer.konghq.com/plugins/ai-proxy/examples/gemini-chat-route.md): Configure a chat route using the Gemini 1.5 Flash model. - [AI Proxy: Native Gemini API route](https://developer.konghq.com/plugins/ai-proxy/examples/gemini-native-routes.md): Use the Google SDK with native Gemini APIs through AI Proxy. - [AI Proxy: Native Hugging Face API route](https://developer.konghq.com/plugins/ai-proxy/examples/hugging-face-native-routes.md): Use the Hugging Face SDK with native APIs through AI Proxy. - [AI Proxy: Chat route with Hugging Face](https://developer.konghq.com/plugins/ai-proxy/examples/huggingface-chat-route.md): Configure a chat route using Hugging Face with the SmolLM model. - [AI Proxy: Image editing route](https://developer.konghq.com/plugins/ai-proxy/examples/image-edits-openai.md): Configure an image editing route using OpenAI’s GPT Image 1.5 model. - [AI Proxy: Image generation route](https://developer.konghq.com/plugins/ai-proxy/examples/image-generation-openai.md): Configure an image generation route using OpenAI’s GPT Image 1.5 model. - [AI Proxy: Chat route with Llama 2](https://developer.konghq.com/plugins/ai-proxy/examples/llama2-chat-route.md): Configure a chat route using a local Llama 2 model with the OLLAMA format. - [AI Proxy: Meter a chat route with OpenAI](https://developer.konghq.com/plugins/ai-proxy/examples/meter-openai-requests.md): Meter a chat route using the OpenAI GPT-4 model using Konnect Metering & Billing. - [AI Proxy: Chat route with Mistral](https://developer.konghq.com/plugins/ai-proxy/examples/mistral-chat-route.md): Configure a chat route using the Mistral Tiny model with the OpenAI format. - [AI Proxy: Chat route with Ollama](https://developer.konghq.com/plugins/ai-proxy/examples/ollama-chat-route.md): Configure a chat route using a local Qwen 3 model. - [AI Proxy: Chat route with OpenAI](https://developer.konghq.com/plugins/ai-proxy/examples/openai-chat-route.md): Configure a chat route using the OpenAI GPT-4 model. - [AI Proxy: Responses route type](https://developer.konghq.com/plugins/ai-proxy/examples/responses-route-type.md): Use the Responses API to fetch metadata about past OpenAI requests for debugging and analysis. - [AI Proxy: OpenAI SDK: Use the Azure deployment relevant to a specific model name](https://developer.konghq.com/plugins/ai-proxy/examples/sdk-azure-deployment.md): Configure a dynamic route to target multiple Azure OpenAI model deployments. - [AI Proxy: OpenAI SDK: Chat route with dynamic model selection](https://developer.konghq.com/plugins/ai-proxy/examples/sdk-dynamic-model-selection.md): Configure a chat route that reads the target model from the request path instead of hardcoding it in the configuration. - [AI Proxy: OpenAI SDK: Multi-deployment chat routing](https://developer.konghq.com/plugins/ai-proxy/examples/sdk-multiple-azure-deployments.md): Use separate Routes to map Azure OpenAI SDK requests to specific deployments of GPT-3.5 and GPT-4. - [AI Proxy: OpenAI SDK: Proxy multiple models deployed in the same Azure instance](https://developer.konghq.com/plugins/ai-proxy/examples/sdk-multiple-providers.md): Configure one route to proxy multiple models deployed in the same Azure instance. - [AI Proxy: OpenAI SDK: Multi-provider chat routing](https://developer.konghq.com/plugins/ai-proxy/examples/sdk-two-routes.md): Use a single OpenAI SDK client to route chat requests to different LLM providers by defining separate Routes per provider. - [AI Proxy: Video generation route](https://developer.konghq.com/plugins/ai-proxy/examples/video-generation-openai.md): Configure a video generation route using OpenAI Sora 2 model. - [AI Proxy: Chat route with vLLM](https://developer.konghq.com/plugins/ai-proxy/examples/vllm-chat-route.md): Configure a chat route using a self-hosted vLLM server. - [AI Proxy: Chat route with xAI](https://developer.konghq.com/plugins/ai-proxy/examples/xai-chat-route.md): Configure a chat route using the xAI Grok 4 model. - [AI Proxy: Image generation with xAI](https://developer.konghq.com/plugins/ai-proxy/examples/xai-image-generation.md): Configure an image generation route with the xAI Grok 2 Image Gen model. - [AI Proxy Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-proxy/reference.md): The AI Proxy plugin lets you transform and proxy requests to a number of AI providers and models. - [AI RAG Injector Plugin](https://developer.konghq.com/plugins/ai-rag-injector.md): Create RAG pipelines by automatically injecting content from a vector database - [AI RAG Injector Plugin OpenAPI Specification](https://developer.konghq.com/plugins/ai-rag-injector/api.md): Create RAG pipelines by automatically injecting content from a vector database - [AI RAG Injector Plugin Changelog](https://developer.konghq.com/plugins/ai-rag-injector/changelog.md): Create RAG pipelines by automatically injecting content from a vector database - [AI RAG Injector: RAG injection with OpenAI and Redis](https://developer.konghq.com/plugins/ai-rag-injector/examples/openai-redis.md): Configure the AI RAG Injector plugin to inject content to use Redis as vector database and the OpenAI text-embedding-3-large model for embedding. - [AI RAG Injector: RAG injection with OpenAI and Valkey](https://developer.konghq.com/plugins/ai-rag-injector/examples/openai-valkey.md): Configure the AI RAG Injector plugin to use Valkey as a vector database and the OpenAI text-embedding-3-large model for embedding. - [AI RAG Injector: RAG injection with ACLs using OpenAI and Redis](https://developer.konghq.com/plugins/ai-rag-injector/examples/rag-acls.md): Configure the AI RAG Injector plugin with access control lists to restrict knowledge base collections based on consumer groups. - [AI RAG Injector Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-rag-injector/reference.md): Create RAG pipelines by automatically injecting content from a vector database - [AI Rate Limiting Advanced Plugin](https://developer.konghq.com/plugins/ai-rate-limiting-advanced.md): Provides rate limiting for the AI plugins. - [AI Rate Limiting Advanced Plugin Changelog](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/changelog.md): Provides rate limiting for the AI plugins. - [AI Rate Limiting Advanced: Enable Consumer Group rate limiting](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/consumer-group-rate-limiting.md): Protect your LLM services with Consumer Group rate limiting. - [AI Rate Limiting Advanced: Enable Consumer rate limiting](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/consumer-rate-limiting.md): Protect your LLM services with Consumer rate limiting. - [AI Rate Limiting Advanced: Enable rate limiting for a header](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/header-rate-limiting.md): Protect your LLM services with header rate limiting. - [AI Rate Limiting Advanced: Enable rate limiting for IP addresses](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/ip-rate-limiting.md): Protect your LLM services with IP rate limiting. - [AI Rate Limiting Advanced: Enable LLM model rate limiting](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/llm-model-rate-limiting.md): Protect your LLM services with model rate limiting. - [AI Rate Limiting Advanced: Enable LLM provider policy-based rate limiting](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/llm-provider-policy-based-rate-limiting.md): Protect your LLM services with rate limiting. - [AI Rate Limiting Advanced: Enable LLM provider rate limiting](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/llm-provider-rate-limiting.md): Protect your LLM services with rate limiting. - [AI Rate Limiting Advanced: Enable rate limiting for a path](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/path-rate-limiting.md): Protect your LLM services with path rate limiting. - [AI Rate Limiting Advanced: Enable rate limiting with multiple conditions](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/rate-limiting-multiple-conditions.md): Protect your LLM services with rate limiting based on multiple conditions. - [AI Rate Limiting Advanced: Request prompt function with AWS ElastiCache cluster auth](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/request-prompt-count-aws-cluster.md): Rate limit requests based on a custom token with AWS ElastiCache cluster auth - [AI Rate Limiting Advanced: Request prompt function with AWS ElastiCache instance auth](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/request-prompt-count-aws-instance.md): Rate limit requests based on a custom token with AWS ElastiCache instance auth - [AI Rate Limiting Advanced: Request prompt function with Azure Managed Redis cluster auth](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/request-prompt-count-azure-cluster.md): Rate limit requests based on a custom token with Azure Managed Redis cluster auth - [AI Rate Limiting Advanced: Request prompt function with Azure Managed Redis instance auth](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/request-prompt-count-azure-instance.md): Rate limit requests based on a custom token with Azure Managed Redis instance auth - [AI Rate Limiting Advanced: Request prompt function](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/request-prompt-count-function.md): Protect your LLM services by rate limiting requests based on a custom token. - [AI Rate Limiting Advanced: Request prompt function with Google Cloud Memorystore cluster auth](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/request-prompt-count-gcp-cluster.md): Rate limit requests based on a custom token with Google Cloud Memorystore cluster auth - [AI Rate Limiting Advanced: Request prompt function Google Cloud Memorystore instance auth](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/examples/request-prompt-count-gcp-instance.md): Rate limit requests based on a custom token with Google Cloud Memorystore instance auth - [AI Rate Limiting Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-rate-limiting-advanced/reference.md): Provides rate limiting for the AI plugins. - [AI Request Transformer Plugin](https://developer.konghq.com/plugins/ai-request-transformer.md): Use an LLM service to transform a client request body prior to proxying the request to the upstream server - [AI Request Transformer Plugin Changelog](https://developer.konghq.com/plugins/ai-request-transformer/changelog.md): Use an LLM service to transform a client request body prior to proxying the request to the upstream server - [AI Request Transformer: Add data to a request body](https://developer.konghq.com/plugins/ai-request-transformer/examples/add-data-to-request-body.md): Configure the AI Request Transformer plugin to use OpenAI GPT-4 to add an element to the client request body before proxying it. - [AI Request Transformer: Translate a request body](https://developer.konghq.com/plugins/ai-request-transformer/examples/translate-request-body.md): Configure the AI Request Transformer plugin to use OpenAI GPT-4 to translate the client request to a different language. In this example, we'll translate the client's question to French. - [AI Request Transformer Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-request-transformer/reference.md): Use an LLM service to transform a client request body prior to proxying the request to the upstream server - [AI Response Transformer Plugin](https://developer.konghq.com/plugins/ai-response-transformer.md): Use an LLM service to transform the upstream HTTP(S) prior to forwarding it to the client - [AI Response Transformer Plugin Changelog](https://developer.konghq.com/plugins/ai-response-transformer/changelog.md): Use an LLM service to transform the upstream HTTP(S) prior to forwarding it to the client - [AI Response Transformer: Add data to a response body](https://developer.konghq.com/plugins/ai-response-transformer/examples/add-data-to-response-body.md): Configure the AI Response Transformer plugin to use OpenAI GPT-4 to add an element to the response body before returning it to the client. - [AI Response Transformer: Add a header to a response body](https://developer.konghq.com/plugins/ai-response-transformer/examples/add-header-to-response-body.md): Configure the AI Response Transfomer plugin to use OpenAI GPT-4 to add a header to the response before returning it to the client. - [AI Response Transformer Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-response-transformer/reference.md): Use an LLM service to transform the upstream HTTP(S) prior to forwarding it to the client - [AI PII Sanitizer Plugin](https://developer.konghq.com/plugins/ai-sanitizer.md): Protect sensitive information in client request or response bodies before they reach upstream services or clients - [AI PII Sanitizer Plugin OpenAPI Specification](https://developer.konghq.com/plugins/ai-sanitizer/api.md): Protect sensitive information in client request or response bodies before they reach upstream services or clients - [AI PII Sanitizer Plugin Changelog](https://developer.konghq.com/plugins/ai-sanitizer/changelog.md): Protect sensitive information in client request or response bodies before they reach upstream services or clients - [AI PII Sanitizer: Anonymize multiple PII categories](https://developer.konghq.com/plugins/ai-sanitizer/examples/anonymize-multiple-pii.md): Configure the plugin to anonymize multiple PII types in requests, including email addresses, phone numbers, SSNs, and dates. - [AI PII Sanitizer: Explicitly anonymize phone numbers in requests](https://developer.konghq.com/plugins/ai-sanitizer/examples/anonymize-phone-numbers.md): Configure the AI Sanitizer plugin to use your sanitizer service to anonymize phone numbers in requests before they reach the upstream service. - [AI PII Sanitizer: Anonymize sensitive data in requests and responses](https://developer.konghq.com/plugins/ai-sanitizer/examples/anonymize-request-and-response-data.md): Configure the AI Sanitizer plugin to use your sanitizer service to anonymize all sensitive data and credentials in both client requests and LLM responses. - [AI PII Sanitizer: Anonymize sensitive data in responses](https://developer.konghq.com/plugins/ai-sanitizer/examples/anonymize-response-data.md): Configure the AI Sanitizer plugin to use your sanitizer service to anonymize all sensitive data and credentials in LLM responses before they reach the client. - [AI PII Sanitizer: Apply full PII coverage with custom API key detection](https://developer.konghq.com/plugins/ai-sanitizer/examples/custom-pattern-all-pii.md): Configure the plugin to anonymize all standard PII types and a custom pattern for AWS API keys in requests. - [AI PII Sanitizer: Anonymize requests with a GitHub token pattern](https://developer.konghq.com/plugins/ai-sanitizer/examples/custom-regex-sanitizer.md): Configure the plugin to anonymize requests using a custom regex pattern for GitHub personal access tokens. - [AI PII Sanitizer: Anonymize high-risk PII categories with custom patterns](https://developer.konghq.com/plugins/ai-sanitizer/examples/high-risk-pii-custom.md): Configure the plugin to anonymize high-risk PII categories (email, phone, SSN, and credit cards) along with custom patterns for sensitive tokens. - [AI PII Sanitizer Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-sanitizer/reference.md): Protect sensitive information in client request or response bodies before they reach upstream services or clients - [AI Semantic Cache Plugin](https://developer.konghq.com/plugins/ai-semantic-cache.md): Enhance performance for AI providers by caching LLM responses semantically - [AI Semantic Cache Plugin OpenAPI Specification](https://developer.konghq.com/plugins/ai-semantic-cache/api.md): Enhance performance for AI providers by caching LLM responses semantically - [AI Semantic Cache Plugin Changelog](https://developer.konghq.com/plugins/ai-semantic-cache/changelog.md): Enhance performance for AI providers by caching LLM responses semantically - [AI Semantic Cache: Set up with Mistral and Redis](https://developer.konghq.com/plugins/ai-semantic-cache/examples/mistral.md): Enable AI Semantic Caching with Mistral embeddings API and a Redis vector database. Configuring Kong to use Mistral as upstream or configure AI Proxy or AI Proxy Adavnced plugin is required. - [AI Semantic Cache: Set up with OpenAI and PGVector](https://developer.konghq.com/plugins/ai-semantic-cache/examples/openai-pgvector.md): Enable AI Semantic Caching with OpenAI embeddings API and a PGVector database. - [AI Semantic Cache: Set up with OpenAI and Valkey](https://developer.konghq.com/plugins/ai-semantic-cache/examples/openai-valkey.md): Enable AI Semantic Caching with OpenAI embeddings API and a Valkey vector database. - [AI Semantic Cache: Set up with OpenAI and Redis](https://developer.konghq.com/plugins/ai-semantic-cache/examples/openai.md): Enable AI Semantic Caching with OpenAI embeddings API and a Redis vector database. - [AI Semantic Cache Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-semantic-cache/reference.md): Enhance performance for AI providers by caching LLM responses semantically - [AI Semantic Prompt Guard Plugin](https://developer.konghq.com/plugins/ai-semantic-prompt-guard.md): Semantically and intelligently create allow and deny lists of topics that can be requested across every LLM. - [AI Semantic Prompt Guard Plugin Changelog](https://developer.konghq.com/plugins/ai-semantic-prompt-guard/changelog.md): Semantically and intelligently create allow and deny lists of topics that can be requested across every LLM. - [AI Semantic Prompt Guard: Allow and deny messages using Valkey](https://developer.konghq.com/plugins/ai-semantic-prompt-guard/examples/allow-and-deny-prompts-valkey.md): Allow messages about a topic as long as they don't contain information about another topic, using Valkey as a vector database. - [AI Semantic Prompt Guard: Allow and deny messages](https://developer.konghq.com/plugins/ai-semantic-prompt-guard/examples/allow-and-deny-prompts.md): Allow messages about a topic as long as they don't contain information about another topic. - [AI Semantic Prompt Guard: Only allow messages about a specific topic](https://developer.konghq.com/plugins/ai-semantic-prompt-guard/examples/allow-prompts.md): Only allow messages about a specific topic. For example, only allow messages about DevOps - [AI Semantic Prompt Guard: Only deny messages about a specific topic](https://developer.konghq.com/plugins/ai-semantic-prompt-guard/examples/deny-prompts.md): Only deny messages about a specific topic. For example, only deny messages about exploiting vulnerabilities. - [AI Semantic Prompt Guard Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-semantic-prompt-guard/reference.md): Semantically and intelligently create allow and deny lists of topics that can be requested across every LLM. - [AI Semantic Response Guard Plugin](https://developer.konghq.com/plugins/ai-semantic-response-guard.md): Permit or block prompts based on semantic similarity to known LLM responses, preventing misuse of llm/v1/chat or llm/v1/completions requests - [AI Semantic Response Guard Plugin Changelog](https://developer.konghq.com/plugins/ai-semantic-response-guard/changelog.md): Permit or block prompts based on semantic similarity to known LLM responses, preventing misuse of llm/v1/chat or llm/v1/completions requests - [AI Semantic Response Guard: Allow and deny using pgvector as a vector database](https://developer.konghq.com/plugins/ai-semantic-response-guard/examples/allow-and-deny-responses-pgvector.md): Block or allow LLM responses based on semantic similarity to defined rules. - [AI Semantic Response Guard: Allow and deny responses using Redis as a vector database](https://developer.konghq.com/plugins/ai-semantic-response-guard/examples/allow-and-deny-responses-redis.md): Block or allow LLM responses based on semantic similarity to defined rules. - [AI Semantic Response Guard: Allow and deny responses using Valkey as a vector database](https://developer.konghq.com/plugins/ai-semantic-response-guard/examples/allow-and-deny-responses-valkey.md): Block or allow LLM responses based on semantic similarity to defined rules, using Valkey as a vector database. - [AI Semantic Response Guard: Allow only responses](https://developer.konghq.com/plugins/ai-semantic-response-guard/examples/allow-responses.md): Allow only specific LLM responses based on semantic similarity to defined rules. - [AI Semantic Response Guard: Deny only responses](https://developer.konghq.com/plugins/ai-semantic-response-guard/examples/deny-responses.md): Block specific LLM responses based on semantic similarity to defined rules. - [AI Semantic Response Guard Plugin Configuration Reference](https://developer.konghq.com/plugins/ai-semantic-response-guard/reference.md): Permit or block prompts based on semantic similarity to known LLM responses, preventing misuse of llm/v1/chat or llm/v1/completions requests - [Akamai API Security Plugin](https://developer.konghq.com/plugins/akamai-api-security.md): Akamai API Security machine learning & prevention blocking for Kong Gateway discovery - [Akamai API Security: Enable Akamai API Security](https://developer.konghq.com/plugins/akamai-api-security/examples/enable-akamai-plugin.md): Enable the Akamai API Security plugin. - [Akamai API Security Plugin Configuration Reference](https://developer.konghq.com/plugins/akamai-api-security/reference.md): Akamai API Security machine learning & prevention blocking for Kong Gateway discovery - [Amberflo.io API Metering Plugin](https://developer.konghq.com/plugins/amberflo.md): API usage metering and usage-based billing - [Amberflo.io API Metering: Enable the Amberflo plugin](https://developer.konghq.com/plugins/amberflo/examples/enable-amberflo.md): Enable the Amberflo.io metering plugin. - [Amberflo.io API Metering Plugin Configuration Reference](https://developer.konghq.com/plugins/amberflo/reference.md): API usage metering and usage-based billing - [AppDynamics Plugin](https://developer.konghq.com/plugins/app-dynamics.md): Integrate Kong Gateway with the AppDynamics APM Platform - [AppDynamics Plugin Changelog](https://developer.konghq.com/plugins/app-dynamics/changelog.md): Integrate Kong Gateway with the AppDynamics APM Platform - [AppDynamics: Enable the AppDynamics plugin](https://developer.konghq.com/plugins/app-dynamics/examples/enable-app-dynamics.md): Enables the AppDynamics plugin. You must install AppDynamics and set environment variables first. - [AppDynamics Plugin Configuration Reference](https://developer.konghq.com/plugins/app-dynamics/reference.md): Integrate Kong Gateway with the AppDynamics APM Platform - [AppSentinels Plugin](https://developer.konghq.com/plugins/appsentinels.md): AppSentinels plugin for API security - [AppSentinels: AuthZ enforcement mode](https://developer.konghq.com/plugins/appsentinels/examples/authz-enforcement-mode.md): Run the AppSentinels plugin in authorization enforcement mode. - [AppSentinels: Logging mode](https://developer.konghq.com/plugins/appsentinels/examples/logging-transparent-mode.md): Run the AppSentinels plugin in transparent logging mode. - [AppSentinels Plugin Configuration Reference](https://developer.konghq.com/plugins/appsentinels/reference.md): AppSentinels plugin for API security - [AWS Lambda Plugin](https://developer.konghq.com/plugins/aws-lambda.md): Invoke and manage AWS Lambda functions from Kong Gateway - [AWS Lambda Plugin Changelog](https://developer.konghq.com/plugins/aws-lambda/changelog.md): Invoke and manage AWS Lambda functions from Kong Gateway - [AWS Lambda: Dedicated Cloud Gateway configuration](https://developer.konghq.com/plugins/aws-lambda/examples/dedicated-cloud-gateway.md): Set up the plugin to invoke a Lambda function with Dedicated Cloud Gateways. - [AWS Lambda: RequestResponse invocation](https://developer.konghq.com/plugins/aws-lambda/examples/requestresponse-invocation.md): Set up the plugin to invoke a Lambda function with the RequestResponse invocation type. - [AWS Lambda Plugin Configuration Reference](https://developer.konghq.com/plugins/aws-lambda/reference.md): Invoke and manage AWS Lambda functions from Kong Gateway - [AWS Request Signing Plugin](https://developer.konghq.com/plugins/aws-request-signing.md): Sign requests with AWS SIGV4 and temp credentials for secure use of AWS Lambdas in Kong - [AWS Request Signing: Enable AWS Request Signing](https://developer.konghq.com/plugins/aws-request-signing/examples/enable-aws-request-signing.md): Enable the AWS Request Signing plugin. - [AWS Request Signing Plugin Configuration Reference](https://developer.konghq.com/plugins/aws-request-signing/reference.md): Sign requests with AWS SIGV4 and temp credentials for secure use of AWS Lambdas in Kong - [Azure Functions Plugin](https://developer.konghq.com/plugins/azure-functions.md): Invoke and manage Azure functions from Kong Gateway - [Azure Functions Plugin Changelog](https://developer.konghq.com/plugins/azure-functions/changelog.md): Invoke and manage Azure functions from Kong Gateway - [Azure Functions: Invoke an Azure function](https://developer.konghq.com/plugins/azure-functions/examples/invoke-azure-function.md): Set up the plugin to invoke an Azure function located in a custom domain. - [Azure Functions Plugin Configuration Reference](https://developer.konghq.com/plugins/azure-functions/reference.md): Invoke and manage Azure functions from Kong Gateway - [Basic Auth Plugin](https://developer.konghq.com/plugins/basic-auth.md): Secure Services and Routes with Basic Authentication - [Basic Auth Plugin OpenAPI Specification](https://developer.konghq.com/plugins/basic-auth/api.md): Secure Services and Routes with Basic Authentication - [Basic Auth Plugin Changelog](https://developer.konghq.com/plugins/basic-auth/changelog.md): Secure Services and Routes with Basic Authentication - [Basic Auth: Allow anonymous consumers](https://developer.konghq.com/plugins/basic-auth/examples/anonymous-consumer.md): Set up basic authentication with an optional string (Consumer UUID or username) value to use as an “anonymous” Consumer if authentication fails. - [Basic Auth: Brute force protection in memory](https://developer.konghq.com/plugins/basic-auth/examples/brute-force-protection-memory.md): Protect against brute force attacks. - [Basic Auth: Brute force protection with Redis](https://developer.konghq.com/plugins/basic-auth/examples/brute-force-protection.md): Protect against brute force attacks. - [Basic Auth: Hide upstream service credentials](https://developer.konghq.com/plugins/basic-auth/examples/hide-upstream-credentials.md): Hides the credentials from the upstream service. - [Basic Auth: Authenticate principals](https://developer.konghq.com/plugins/basic-auth/examples/principal.md): Authenticate principals managed by Kong Identity by configuring the `principals` field in the Basic Auth plugin. - [Basic Auth Plugin Configuration Reference](https://developer.konghq.com/plugins/basic-auth/reference.md): Secure Services and Routes with Basic Authentication - [Bot Detection Plugin](https://developer.konghq.com/plugins/bot-detection.md): Detect and block bots or custom clients - [Bot Detection: Allow bots based on custom regex](https://developer.konghq.com/plugins/bot-detection/examples/allow.md): Allow bots in the User_Agent header that match the custom regex you configure. User_Agent headers in requests that match are processed per usual. - [Bot Detection: Block common bots](https://developer.konghq.com/plugins/bot-detection/examples/default.md): Block common bots using built-in regex. - [Bot Detection: Deny bots based on custom regex](https://developer.konghq.com/plugins/bot-detection/examples/deny.md): Block bots in the User_Agent header that match the custom regex you configure. User_Agent headers in requests that match are blocked with a `403` error. - [Bot Detection Plugin Configuration Reference](https://developer.konghq.com/plugins/bot-detection/reference.md): Detect and block bots or custom clients - [Canary Release Plugin](https://developer.konghq.com/plugins/canary.md): Slowly roll out software changes to a subset of users - [Canary Release Plugin Changelog](https://developer.konghq.com/plugins/canary/changelog.md): Slowly roll out software changes to a subset of users - [Canary Release: Route traffic by ACL group](https://developer.konghq.com/plugins/canary/examples/route-by-acl-group.md): Route all traffic for a specific group of Consumers to a secondary upstream service. - [Canary Release: Route traffic by fixed percentage](https://developer.konghq.com/plugins/canary/examples/route-by-fixed-percentage.md): Set a fixed percentage of traffic to be routed to a secondary upstream service. - [Canary Release: Transfer traffic over time](https://developer.konghq.com/plugins/canary/examples/transfer-traffic-over-time.md): Schedule a canary release to start at a specific time, in UNIX timestamp seconds since epoch, and finish migrating 100% of traffic in a specified length of time, in seconds. - [Canary Release: Use health checks](https://developer.konghq.com/plugins/canary/examples/upstream-fallback.md): Use Upstream health checks to skip applying the canary upstream if it doesn't have at least one healthy target. If the canary is unhealthy, traffic falls back to the primary upstream service. - [Canary Release Plugin Configuration Reference](https://developer.konghq.com/plugins/canary/reference.md): Slowly roll out software changes to a subset of users - [Confluent Consume Plugin](https://developer.konghq.com/plugins/confluent-consume.md): Consume messages from Confluent Cloud Kafka topics and make them available through HTTP endpoints - [Confluent Consume Plugin Changelog](https://developer.konghq.com/plugins/confluent-consume/changelog.md): Consume messages from Confluent Cloud Kafka topics and make them available through HTTP endpoints - [Confluent Consume: Consumer group ID per Kong Gateway Consumer](https://developer.konghq.com/plugins/confluent-consume/examples/consumer-group-kong-consumer.md): Set the Kafka consumer group ID from the authenticated Kong Gateway Consumer's username. - [Confluent Consume: Fixed consumer group ID](https://developer.konghq.com/plugins/confluent-consume/examples/consumer-group-manual.md): Use a fixed, operator-chosen consumer group ID to work with ACL-enforced Kafka clusters. - [Confluent Consume: Filter messages with Lua custom filter code](https://developer.konghq.com/plugins/confluent-consume/examples/filter-messages.md): Configure the Confluent Consume plugin to filter messages with Lua custom filter code. In this example, the Confluent Consume plugin filters by empty values. - [Confluent Consume: HTTP GET](https://developer.konghq.com/plugins/confluent-consume/examples/http-get.md): Configure the plugin to consume messages via HTTP GET requests. - [Confluent Consume: SASL/OAUTHBEARER authentication](https://developer.konghq.com/plugins/confluent-consume/examples/oauthbearer.md): Authenticate to Confluent Cloud using SASL/OAUTHBEARER. Kong Gateway fetches and renews OAuth 2.0 access tokens automatically using the client credentials grant. - [Confluent Consume: Confluent Schema Registry with OAuth2](https://developer.konghq.com/plugins/confluent-consume/examples/schema-registry-oauth2.md): Configure the Confluent Consume plugin to use the Confluent Schema Registry for message deserialization and secure it with OAuth 2.0 token authentication. - [Confluent Consume: Confluent Schema Registry](https://developer.konghq.com/plugins/confluent-consume/examples/schema-registry.md): Configure the Confluent Consume plugin to use the Confluent Schema Registry for message deserialization. - [Confluent Consume: Server-sent events](https://developer.konghq.com/plugins/confluent-consume/examples/server-sent-events.md): Configure the plugin to stream messages using server-sent events. - [Confluent Consume: Transform messages with Lua custom filter code](https://developer.konghq.com/plugins/confluent-consume/examples/transform-messages.md): Configure the Confluent Consume plugin to transform messages with Lua custom filter code. In this example, the Confluent Consume plugin normalizes messages to a table and decodes them into JSON when possible. - [Confluent Consume: Websocket mode](https://developer.konghq.com/plugins/confluent-consume/examples/websocket.md): Configure the Confluent Consume plugin to stream messages over WebSockets. - [Confluent Consume Plugin Configuration Reference](https://developer.konghq.com/plugins/confluent-consume/reference.md): Consume messages from Confluent Cloud Kafka topics and make them available through HTTP endpoints - [Confluent Plugin](https://developer.konghq.com/plugins/confluent.md): Transform requests into Kafka messages in a Confluent Kafka topic. - [Confluent Plugin Changelog](https://developer.konghq.com/plugins/confluent/changelog.md): Transform requests into Kafka messages in a Confluent Kafka topic. - [Confluent: Compress messages before sending to Kafka](https://developer.konghq.com/plugins/confluent/examples/compress-messages.md): Compress producer batches before sending them to Confluent Cloud. - [Confluent: Disable asynchronous events](https://developer.konghq.com/plugins/confluent/examples/disable-async.md): Streams data to Confluent Cloud, but disables asynchronous events. - [Confluent: SASL/OAUTHBEARER authentication](https://developer.konghq.com/plugins/confluent/examples/oauthbearer.md): Authenticate to Confluent Cloud using SASL/OAUTHBEARER. Kong Gateway fetches and renews OAuth 2.0 access tokens automatically using the client credentials grant. - [Confluent: Forward HTTP headers as Kafka record headers (allowlist mode)](https://developer.konghq.com/plugins/confluent/examples/record-headers-allowlist.md): Forward selected HTTP request headers as Kafka record headers. - [Confluent: Forward HTTP headers as Kafka record headers (blocklist mode)](https://developer.konghq.com/plugins/confluent/examples/record-headers-blocklist.md): Forward all HTTP request headers as Kafka record headers, except those on an exclusion list. - [Confluent: Simple JSON encoding for Avro schemas](https://developer.konghq.com/plugins/confluent/examples/schema-registry-simple-json.md): Configure the Confluent plugin to accept plain JSON for an Avro schema with nullable fields, instead of Avro-encoded JSON with type-tagged unions. - [Confluent: Confluent Schema Registry](https://developer.konghq.com/plugins/confluent/examples/schema-registry.md): Configure the Confluent plugin to use the Confluent Schema Registry for validation and message serialization. - [Confluent Plugin Configuration Reference](https://developer.konghq.com/plugins/confluent/reference.md): Transform requests into Kafka messages in a Confluent Kafka topic. - [Correlation ID Plugin](https://developer.konghq.com/plugins/correlation-id.md): Correlate requests and responses using a unique ID - [Correlation ID Plugin Changelog](https://developer.konghq.com/plugins/correlation-id/changelog.md): Correlate requests and responses using a unique ID - [Correlation ID: Generate a single UUID on a per-worker basis](https://developer.konghq.com/plugins/correlation-id/examples/generate-uuid.md): Generates a single UUID on a per-worker basis and the requests append a counter to the UUID after a `#` character. - [Correlation ID Plugin Configuration Reference](https://developer.konghq.com/plugins/correlation-id/reference.md): Correlate requests and responses using a unique ID - [CORS Plugin](https://developer.konghq.com/plugins/cors.md): The CORS plugin lets you add Cross-Origin Resource Sharing (CORS) to a Service or a Route. - [CORS Plugin Changelog](https://developer.konghq.com/plugins/cors/changelog.md): The CORS plugin lets you add Cross-Origin Resource Sharing (CORS) to a Service or a Route. - [CORS: Allow requests from a specific domain](https://developer.konghq.com/plugins/cors/examples/allow-requests-from-specific-domain.md): Configures the CORS plugin to allow GET and POST requests from a specific domain. - [CORS: Enable "Try it" in Dev Portal for requests with any header](https://developer.konghq.com/plugins/cors/examples/try-it-headers.md): Configures the CORS plugin to support sending requests with any headers from the Dev Portal spec renderer. - [CORS Plugin Configuration Reference](https://developer.konghq.com/plugins/cors/reference.md): The CORS plugin lets you add Cross-Origin Resource Sharing (CORS) to a Service or a Route. - [CrowdStrike Falcon AIDR MCP Plugin](https://developer.konghq.com/plugins/crowdstrike-aidr-mcp.md): Inspect Model Context Protocol tool listings, tool call inputs, and tool outputs against CrowdStrike Falcon AIDR policies, blocking malicious or sensitive traffic before it reaches the client or MCP server - [CrowdStrike Falcon AIDR MCP: Enable CrowdStrike Falcon AIDR MCP](https://developer.konghq.com/plugins/crowdstrike-aidr-mcp/examples/enable-crowdstrike-aidr-mcp.md): Enable the CrowdStrike Falcon AIDR MCP plugin to inspect MCP tool listings, tool call inputs, and tool outputs against AIDR policies. - [CrowdStrike Falcon AIDR MCP Plugin Configuration Reference](https://developer.konghq.com/plugins/crowdstrike-aidr-mcp/reference.md): Inspect Model Context Protocol tool listings, tool call inputs, and tool outputs against CrowdStrike Falcon AIDR policies, blocking malicious or sensitive traffic before it reaches the client or MCP server - [CrowdStrike Falcon AIDR Request Plugin](https://developer.konghq.com/plugins/crowdstrike-aidr-request.md): Inspect AI prompts against CrowdStrike Falcon AIDR input rules, blocking threats before they reach the upstream LLM - [CrowdStrike Falcon AIDR Request: Enable CrowdStrike Falcon AIDR Request](https://developer.konghq.com/plugins/crowdstrike-aidr-request/examples/enable-crowdstrike-aidr-request.md): Enable the CrowdStrike Falcon AIDR Request plugin to inspect AI prompts against AIDR Input Rules before forwarding to the upstream LLM. - [CrowdStrike Falcon AIDR Request Plugin Configuration Reference](https://developer.konghq.com/plugins/crowdstrike-aidr-request/reference.md): Inspect AI prompts against CrowdStrike Falcon AIDR input rules, blocking threats before they reach the upstream LLM - [CrowdStrike Falcon AIDR Response Plugin](https://developer.konghq.com/plugins/crowdstrike-aidr-response.md): Inspect LLM responses against CrowdStrike Falcon AIDR output rules, redacting or blocking sensitive content before delivery to the client - [CrowdStrike Falcon AIDR Response: Enable CrowdStrike Falcon AIDR Response](https://developer.konghq.com/plugins/crowdstrike-aidr-response/examples/enable-crowdstrike-aidr-response.md): Enable the CrowdStrike Falcon AIDR Response plugin to inspect LLM responses against AIDR Output Rules before returning to the client. - [CrowdStrike Falcon AIDR Response Plugin Configuration Reference](https://developer.konghq.com/plugins/crowdstrike-aidr-response/reference.md): Inspect LLM responses against CrowdStrike Falcon AIDR output rules, redacting or blocking sensitive content before delivery to the client - [Datadog Plugin](https://developer.konghq.com/plugins/datadog.md): Visualize metrics on Datadog - [Datadog Plugin Changelog](https://developer.konghq.com/plugins/datadog/changelog.md): Visualize metrics on Datadog - [Datadog: Log request count](https://developer.konghq.com/plugins/datadog/examples/request-count.md): Configure the plugin to log request counts and identify the Consumers using their Consumer ID. - [Datadog Plugin Configuration Reference](https://developer.konghq.com/plugins/datadog/reference.md): Visualize metrics on Datadog - [DataDome Plugin](https://developer.konghq.com/plugins/datadome.md): Detect and mitigate attacks on mobile apps, websites, and APIs with DataDome bot and online fraud protection - [DataDome: Enable DataDome](https://developer.konghq.com/plugins/datadome/examples/enable-datadome-plugin.md): Enable the DataDome plugin. - [DataDome Plugin Configuration Reference](https://developer.konghq.com/plugins/datadome/reference.md): Detect and mitigate attacks on mobile apps, websites, and APIs with DataDome bot and online fraud protection - [Datakit Plugin](https://developer.konghq.com/plugins/datakit.md): Datakit is a workflow engine for working with external APIs - [Datakit Plugin Changelog](https://developer.konghq.com/plugins/datakit/changelog.md): Datakit is a workflow engine for working with external APIs - [Datakit: Authenticate Consumer using multiple JWTs from different sources](https://developer.konghq.com/plugins/datakit/examples/authenticate-consumer-from-multiple-jwts.md): Authenticate a Consumer by verifying a JWT from one of two possible sources, each backed by a different JWKS. - [Datakit: Authenticate Kong to a third-party service resolved at runtime](https://developer.konghq.com/plugins/datakit/examples/authenticate-third-party-with-dynamic-url.md): Use a dynamic internal auth endpoint to inject request headers before proxying a request. - [Datakit: Authenticate Kong to a third-party service](https://developer.konghq.com/plugins/datakit/examples/authenticate-third-party.md): Use internal auth within your ecosystem to inject request headers before proxying a request. - [Datakit: Authenticate to a third-party service using Vault secrets](https://developer.konghq.com/plugins/datakit/examples/authenticate-with-vault-secret.md): Authenticate to a third-party service using Vault secrets. - [Datakit: Clear request headers](https://developer.konghq.com/plugins/datakit/examples/clear-headers.md): Use the Datakit plugin to dynamically clear headers from inputs to service_request and response nodes. - [Datakit: Combine multiple API responses](https://developer.konghq.com/plugins/datakit/examples/combine-two-apis-into-one-response.md): Make requests to multiple APIs and combine their responses into one response. - [Datakit: Conditionally fetch or store cache data](https://developer.konghq.com/plugins/datakit/examples/conditionally-store-cached-items.md): Conditionally fetch or store cache data. - [Datakit: Transform JSON into XML](https://developer.konghq.com/plugins/datakit/examples/convert-json-into-xml.md): Use the Datakit plugin to transform JSON request bodies into XML. - [Datakit: Transform JSON into XML and back](https://developer.konghq.com/plugins/datakit/examples/convert-json-to-xml-and-back.md): Use the Datakit plugin to transform JSON request bodies into XML before sending them to an external service, then convert the XML response back into JSON. - [Datakit: Transform XML into JSON](https://developer.konghq.com/plugins/datakit/examples/convert-xml-into-json.md): Use the Datakit plugin to transform XML request bodies into JSON. - [Datakit: Manipulate request headers](https://developer.konghq.com/plugins/datakit/examples/manipulate-request-headers.md): Use the Datakit plugin to dynamically adjust request headers before passing them to a third-party service. - [Datakit: Route requests to different targets based on the authenticated caller](https://developer.konghq.com/plugins/datakit/examples/route-host-by-credential.md): Map an authenticated credential to a host:port target and override the backend per request, bypassing load balancing. - [Datakit: Route requests to different upstreams based on the authenticated caller](https://developer.konghq.com/plugins/datakit/examples/route-upstream-by-credential.md): Map an authenticated credential to a named Upstream entity and override the backend per request. - [Datakit: Sign JWT with Consumer ID](https://developer.konghq.com/plugins/datakit/examples/sign-consumer-jwt.md): Sign an outgoing JWT in a request header using the authenticated Consumer's ID as the subject. - [Datakit: Sign JWT with Principal ID](https://developer.konghq.com/plugins/datakit/examples/sign-principal-jwt.md): Sign an outgoing JWT in a request header using the authenticated Principal's ID as the subject. - [Datakit: Verify TLS connection using a custom CA](https://developer.konghq.com/plugins/datakit/examples/verify-call-node-with-custom-ca.md): Verify a call node's outbound TLS connection against a private CA using the plugin's `ca_certificates` field, then return the response directly to the client. - [Datakit Plugin Configuration Reference](https://developer.konghq.com/plugins/datakit/reference.md): Datakit is a workflow engine for working with external APIs - [DeGraphQL Plugin](https://developer.konghq.com/plugins/degraphql.md): Transform a GraphQL upstream into a REST API - [DeGraphQL Plugin OpenAPI Specification](https://developer.konghq.com/plugins/degraphql/api.md): Transform a GraphQL upstream into a REST API - [DeGraphQL Plugin Changelog](https://developer.konghq.com/plugins/degraphql/changelog.md): Transform a GraphQL upstream into a REST API - [DeGraphQL: Enable DeGraphQL](https://developer.konghq.com/plugins/degraphql/examples/enable-degraphql.md): Enable the DeGraphQL plugin to disable regular Gateway Service function. - [DeGraphQL Plugin Configuration Reference](https://developer.konghq.com/plugins/degraphql/reference.md): Transform a GraphQL upstream into a REST API - [Entitlement Enforcement Plugin](https://developer.konghq.com/plugins/entitlement-enforcement.md): Allow or deny API requests based on customer entitlements. Checks feature access and usage limits against Metering & Billing before routing traffic. - [Entitlement Enforcement Plugin Changelog](https://developer.konghq.com/plugins/entitlement-enforcement/changelog.md): Allow or deny API requests based on customer entitlements. Checks feature access and usage limits against Metering & Billing before routing traffic. - [Entitlement Enforcement: Enforce entitlements by header, with a custom denial response](https://developer.konghq.com/plugins/entitlement-enforcement/examples/enforce-by-header-with-custom-response.md): Identify the customer from a request header and customize the denial response. - [Entitlement Enforcement: Enforce entitlements for a feature](https://developer.konghq.com/plugins/entitlement-enforcement/examples/enforce-entitlements-for-a-feature.md): Set up the Entitlement Enforcement plugin to enforce feature access and usage limits for consumers, using Redis for caching. - [Entitlement Enforcement Plugin Configuration Reference](https://developer.konghq.com/plugins/entitlement-enforcement/reference.md): Allow or deny API requests based on customer entitlements. Checks feature access and usage limits against Metering & Billing before routing traffic. - [Exit Transformer Plugin](https://developer.konghq.com/plugins/exit-transformer.md): Customize Kong exit responses sent downstream - [Exit Transformer Plugin Changelog](https://developer.konghq.com/plugins/exit-transformer/changelog.md): Customize Kong exit responses sent downstream - [Exit Transformer: Customize the 404 error message](https://developer.konghq.com/plugins/exit-transformer/examples/customize-404-message.md): Configure the Exit Transformer plugin to transform 404 responses and add a custom error message. - [Exit Transformer: Customize the response body and headers](https://developer.konghq.com/plugins/exit-transformer/examples/customize-body-and-headers.md): Configure the plugin to replace or add messages and headers in responses. - [Exit Transformer: Return custom 404 error in HTML](https://developer.konghq.com/plugins/exit-transformer/examples/customize-html-404-message.md): Configure the Exit Transformer plugin to transform 404 responses into custom HTML. - [Exit Transformer Plugin Configuration Reference](https://developer.konghq.com/plugins/exit-transformer/reference.md): Customize Kong exit responses sent downstream - [File Log Plugin](https://developer.konghq.com/plugins/file-log.md): Append request and response data to a log file - [File Log Plugin Changelog](https://developer.konghq.com/plugins/file-log/changelog.md): Append request and response data to a log file - [File Log: Specify output log file path](https://developer.konghq.com/plugins/file-log/examples/output-log-file-path.md): Enables the plugin and specifies the path to the output log file. The plugin creates the log file if it doesn’t exist yet. - [File Log Plugin Configuration Reference](https://developer.konghq.com/plugins/file-log/reference.md): Append request and response data to a log file - [Forward Proxy Advanced Plugin](https://developer.konghq.com/plugins/forward-proxy.md): Allows Kong Gateway to connect to intermediary transparent HTTP proxies - [Forward Proxy Advanced Plugin Changelog](https://developer.konghq.com/plugins/forward-proxy/changelog.md): Allows Kong Gateway to connect to intermediary transparent HTTP proxies - [Forward Proxy Advanced: Forward HTTP requests with auth](https://developer.konghq.com/plugins/forward-proxy/examples/forward-requests-with-auth.md): Set up the Forward Proxy plugin to forward requests through a transparent proxy with authentication. - [Forward Proxy Advanced: Forward HTTP requests without auth or CA validation](https://developer.konghq.com/plugins/forward-proxy/examples/forward-requests-without-auth.md): Set up the Forward Proxy plugin to forward requests through a transparent proxy without authentication or CA certificate validation. - [Forward Proxy Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/forward-proxy/reference.md): Allows Kong Gateway to connect to intermediary transparent HTTP proxies - [GraphQL Proxy Caching Advanced Plugin](https://developer.konghq.com/plugins/graphql-proxy-cache-advanced.md): Cache and serve commonly requested responses in Kong Gateway - [GraphQL Proxy Caching Advanced Plugin OpenAPI Specification](https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/api.md): Cache and serve commonly requested responses in Kong Gateway - [GraphQL Proxy Caching Advanced Plugin Changelog](https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/changelog.md): Cache and serve commonly requested responses in Kong Gateway - [GraphQL Proxy Caching Advanced: GraphQL proxy cache with memory storage](https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/examples/graphql-proxy-cache-in-memory.md): Store GraphQL proxy cache data in memory. - [GraphQL Proxy Caching Advanced: GraphQL proxy cache with Redis storage](https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/examples/graphql-proxy-cache-redis.md): Store GraphQL proxy cache data in a Redis database. - [GraphQL Proxy Caching Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/reference.md): Cache and serve commonly requested responses in Kong Gateway - [GraphQL Rate Limiting Advanced Plugin](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced.md): Provides rate limiting for GraphQL queries - [GraphQL Rate Limiting Advanced Plugin OpenAPI Specification](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced/api.md): Provides rate limiting for GraphQL queries - [GraphQL Rate Limiting Advanced Plugin Changelog](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced/changelog.md): Provides rate limiting for GraphQL queries - [GraphQL Rate Limiting Advanced: Limit query cost](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced/examples/limit-query-cost.md): Define a maximum cost applied to any query, regardless of whether or not the call is within the rate limits for a consumer. - [GraphQL Rate Limiting Advanced: Modify costs by score factor](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced/examples/modify-costs-using-score-factor.md): Modify GraphQL rate limiting costs using a score factor. - [GraphQL Rate Limiting Advanced: Sliding window with node quantifier cost strategy](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced/examples/multiple-time-windows-with-node-quantifier-strategy.md): Multiply time windows by calculating costs using the node quantifier strategy. - [GraphQL Rate Limiting Advanced: Fixed window with default cost strategy](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced/examples/single-time-window-with-default-strategy.md): A strict limit of 100 requests per minute using the `default` cost strategy. - [GraphQL Rate Limiting Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/graphql-rate-limiting-advanced/reference.md): Provides rate limiting for GraphQL queries - [gRPC-Gateway Plugin](https://developer.konghq.com/plugins/grpc-gateway.md): Access gRPC services through HTTP REST - [gRPC-Gateway Plugin Changelog](https://developer.konghq.com/plugins/grpc-gateway/changelog.md): Access gRPC services through HTTP REST - [gRPC-Gateway: Use a Protobuf definition](https://developer.konghq.com/plugins/grpc-gateway/examples/use-protobuf-definition.md): Configure the grpc-Gateway plugin to call a Protobuf definition. - [gRPC-Gateway Plugin Configuration Reference](https://developer.konghq.com/plugins/grpc-gateway/reference.md): Access gRPC services through HTTP REST - [gRPC-Web Plugin](https://developer.konghq.com/plugins/grpc-web.md): Allow browser clients to call gRPC services - [gRPC-Web Plugin Changelog](https://developer.konghq.com/plugins/grpc-web/changelog.md): Allow browser clients to call gRPC services - [gRPC-Web: Use a Protobuf definition](https://developer.konghq.com/plugins/grpc-web/examples/use-protobuf-definition.md): Configure the plugin to call a Protobuf definition named `hello.proto`. - [gRPC-Web Plugin Configuration Reference](https://developer.konghq.com/plugins/grpc-web/reference.md): Allow browser clients to call gRPC services - [Harness AI Security Plugin](https://developer.konghq.com/plugins/harness-ai-security.md): Detect, redact, or block sensitive data in AI request and response traffic flowing through Kong Gateway - [Harness AI Security: Enable Harness AI Security](https://developer.konghq.com/plugins/harness-ai-security/examples/enable-harness-ai-security.md): Enable the Harness AI Security plugin to redact or block sensitive data in AI request and response traffic. - [Harness AI Security Plugin Configuration Reference](https://developer.konghq.com/plugins/harness-ai-security/reference.md): Detect, redact, or block sensitive data in AI request and response traffic flowing through Kong Gateway - [Harness WAAP Plugin](https://developer.konghq.com/plugins/harness-waap.md): Capture full API/AI traffic in Kong Gateway, assess security posture, and block attacks with inline enforcement - [Harness WAAP: Enable Harness WAAP](https://developer.konghq.com/plugins/harness-waap/examples/enable-harness-waap.md): Enable the Harness WAAP plugin to send data to Traceable. - [Harness WAAP Plugin Configuration Reference](https://developer.konghq.com/plugins/harness-waap/reference.md): Capture full API/AI traffic in Kong Gateway, assess security posture, and block attacks with inline enforcement - [Header Cert Authentication Plugin](https://developer.konghq.com/plugins/header-cert-auth.md): Authenticate clients with mTLS certificates passed in headers by a WAF or load balancer - [Header Cert Authentication Plugin OpenAPI Specification](https://developer.konghq.com/plugins/header-cert-auth/api.md): Authenticate clients with mTLS certificates passed in headers by a WAF or load balancer - [Header Cert Authentication Plugin Changelog](https://developer.konghq.com/plugins/header-cert-auth/changelog.md): Authenticate clients with mTLS certificates passed in headers by a WAF or load balancer - [Header Cert Authentication: Application Load Balancer (ALB) integration](https://developer.konghq.com/plugins/header-cert-auth/examples/aws-alb.md): Allows you to integrate Amazon Application Load Balancer (ALB) with the Header Cert Authentication plugin. - [Header Cert Authentication: Enable Header Cert Auth](https://developer.konghq.com/plugins/header-cert-auth/examples/enable-header-cert-auth.md): Enables the Header Cert Authentication plugin with the CA certificate. Only allows requests from trusted IPs. - [Header Cert Authentication Plugin Configuration Reference](https://developer.konghq.com/plugins/header-cert-auth/reference.md): Authenticate clients with mTLS certificates passed in headers by a WAF or load balancer - [HMAC Auth Plugin](https://developer.konghq.com/plugins/hmac-auth.md): Add HMAC Authentication to your Gateway Services - [HMAC Auth Plugin OpenAPI Specification](https://developer.konghq.com/plugins/hmac-auth/api.md): Add HMAC Authentication to your Gateway Services - [HMAC Auth Plugin Changelog](https://developer.konghq.com/plugins/hmac-auth/changelog.md): Add HMAC Authentication to your Gateway Services - [HMAC Auth: Enforce headers, body validation, and HMAC digest algorithms](https://developer.konghq.com/plugins/hmac-auth/examples/enforce-headers-body-validation-algorithms.md): Enforces headers that the client should use during HTTP signature creation, as well as body validation. Specifies that the `hmac-sha256` algorithm should be used to hash the digest. - [HMAC Auth: Show credentials](https://developer.konghq.com/plugins/hmac-auth/examples/show-credentials.md): Shows credentials to the upstream service. - [HMAC Auth Plugin Configuration Reference](https://developer.konghq.com/plugins/hmac-auth/reference.md): Add HMAC Authentication to your Gateway Services - [HTTP Log Plugin](https://developer.konghq.com/plugins/http-log.md): Send request and response logs to an HTTP server - [HTTP Log Plugin Changelog](https://developer.konghq.com/plugins/http-log/changelog.md): Send request and response logs to an HTTP server - [HTTP Log: Send HTTP logs with custom header](https://developer.konghq.com/plugins/http-log/examples/custom-headers.md): Send HTTP logs to a log server while specifying a custom header. Custom headers are often used for authorization. - [HTTP Log: Send HTTP logs to Splunk](https://developer.konghq.com/plugins/http-log/examples/http-log-with-splunk.md): Use the HTTP Log plugin to send Kong Gateway raw text logs to Splunk. - [HTTP Log: Send HTTP logs over mTLS](https://developer.konghq.com/plugins/http-log/examples/mtls.md): Send HTTP logs over mTLS by configuring a client certificate for mutual TLS authentication with the log server. - [HTTP Log Plugin Configuration Reference](https://developer.konghq.com/plugins/http-log/reference.md): Send request and response logs to an HTTP server - [Imperva API Security Plugin](https://developer.konghq.com/plugins/imp-appsec-connector.md): Integrate Kong Gateway with Imperva API Security to discover, monitor, and protect APIs - [Imperva API Security: Enable Imperva](https://developer.konghq.com/plugins/imp-appsec-connector/examples/enable-imperva.md): Enable the Imperva plugin. - [Imperva API Security Plugin Configuration Reference](https://developer.konghq.com/plugins/imp-appsec-connector/reference.md): Integrate Kong Gateway with Imperva API Security to discover, monitor, and protect APIs - [Impart Security Plugin](https://developer.konghq.com/plugins/impart.md): Block LLM, agent, and MCP attacks in real time with Impart Security's runtime enforcement platform for Kong Gateway. - [Impart Security: Enable Impart](https://developer.konghq.com/plugins/impart/examples/enable-impart.md): Enable the Impart plugin. - [Impart Security Plugin Configuration Reference](https://developer.konghq.com/plugins/impart/reference.md): Block LLM, agent, and MCP attacks in real time with Impart Security's runtime enforcement platform for Kong Gateway. - [Inigo GraphQL Plugin](https://developer.konghq.com/plugins/inigo.md): Integrate Kong API Gateway with Inigo GraphQL Observability and Security - [Inigo GraphQL: Enable Inigo](https://developer.konghq.com/plugins/inigo/examples/enable-inigo.md): Enable the Inigo plugin. - [Inigo GraphQL Plugin Configuration Reference](https://developer.konghq.com/plugins/inigo/reference.md): Integrate Kong API Gateway with Inigo GraphQL Observability and Security - [Injection Protection Plugin](https://developer.konghq.com/plugins/injection-protection.md): Detect and block injection attacks using regular expressions - [Injection Protection Plugin Changelog](https://developer.konghq.com/plugins/injection-protection/changelog.md): Detect and block injection attacks using regular expressions - [Injection Protection: All injections](https://developer.konghq.com/plugins/injection-protection/examples/all-injections.md): This configuration detects all the built-in injection attacks supported by the Injection Protection plugin. - [Injection Protection: Custom regex injection](https://developer.konghq.com/plugins/injection-protection/examples/custom.md): Specify a custom regex for the Injection Protection plugin. - [Injection Protection: Java exception injection](https://developer.konghq.com/plugins/injection-protection/examples/java-exception.md): Detects denial-of-service (DoS) attacks that match Java exception messages. - [Injection Protection: JavaScript injection](https://developer.konghq.com/plugins/injection-protection/examples/javascript.md): Detects arbitrarily injected JavaScript that is part of a cross site scripting attack and will execute in the browser. - [Injection Protection: Server-side include injection](https://developer.konghq.com/plugins/injection-protection/examples/server-side-include.md): Detects scripts injected in HTML pages. - [Injection Protection: SQL injection](https://developer.konghq.com/plugins/injection-protection/examples/sql.md): Detects scripts injected in HTML pages. - [Injection Protection: XPath abbreviated injection](https://developer.konghq.com/plugins/injection-protection/examples/xpath-abbreviated.md): Detects intentionally malformed information that is sent to a website with the intention of constructing an XPath query for XML data, specifically in abbreviated syntax. - [Injection Protection: XPath extended injection](https://developer.konghq.com/plugins/injection-protection/examples/xpath-extended.md): Detects intentionally malformed information that is sent to a website with the intention of constructing an XPath query for XML data, specifically in the full syntax. - [Injection Protection Plugin Configuration Reference](https://developer.konghq.com/plugins/injection-protection/reference.md): Detect and block injection attacks using regular expressions - [IP Restriction Plugin](https://developer.konghq.com/plugins/ip-restriction.md): Allow or deny IPs that can make requests to your services - [IP Restriction Plugin Changelog](https://developer.konghq.com/plugins/ip-restriction/changelog.md): Allow or deny IPs that can make requests to your services - [IP Restriction: Allow a range of IPs and deny an IP address](https://developer.konghq.com/plugins/ip-restriction/examples/allow-and-deny.md): Configure the plugin to allow access to a range of IPs, but deny a specific IP address in that range. - [IP Restriction: Allow an IP and a range](https://developer.konghq.com/plugins/ip-restriction/examples/allow.md): Configure the plugin to allow access to a specific IP address and to an IP range, and deny all other IPs. - [IP Restriction: Deny an IP range](https://developer.konghq.com/plugins/ip-restriction/examples/deny.md): Configure the plugin to deny access to an IP range and allow access to all other IPs. - [IP Restriction Plugin Configuration Reference](https://developer.konghq.com/plugins/ip-restriction/reference.md): Allow or deny IPs that can make requests to your services - [jq Plugin](https://developer.konghq.com/plugins/jq.md): Transform JSON objects included in API requests or responses using jq programs - [jq Plugin Changelog](https://developer.konghq.com/plugins/jq/changelog.md): Transform JSON objects included in API requests or responses using jq programs - [jq: Write a jq request program](https://developer.konghq.com/plugins/jq/examples/jq-request-program.md): Write a jq request program using the jq plugin. - [jq Plugin Configuration Reference](https://developer.konghq.com/plugins/jq/reference.md): Transform JSON objects included in API requests or responses using jq programs - [JSON Threat Protection Plugin](https://developer.konghq.com/plugins/json-threat-protection.md): Apply size checks on JSON payload and minimize risk of content-level attacks - [JSON Threat Protection Plugin Changelog](https://developer.konghq.com/plugins/json-threat-protection/changelog.md): Apply size checks on JSON payload and minimize risk of content-level attacks - [JSON Threat Protection: Allow non-JSON requests](https://developer.konghq.com/plugins/json-threat-protection/examples/allow-non-json-requests.md): Block invalid requests with the JSON Threat Protection plugin and let non-JSON requests pass through. - [JSON Threat Protection: Log invalid requests without blocking](https://developer.konghq.com/plugins/json-threat-protection/examples/tap-mode.md): Run the JSON Threat Protection plugin in tap mode. In tap mode, you define a JSON threat protection policy and the plugin logs any invalid requests as warnings. It still allows Kong Gateway to proxy non-conforming requests to the upstream service. - [JSON Threat Protection: Block invalid requests](https://developer.konghq.com/plugins/json-threat-protection/examples/threat-protection-policy.md): Run the JSON Threat Protection plugin in block mode. - [JSON Threat Protection Plugin Configuration Reference](https://developer.konghq.com/plugins/json-threat-protection/reference.md): Apply size checks on JSON payload and minimize risk of content-level attacks - [JWE Decrypt Plugin](https://developer.konghq.com/plugins/jwe-decrypt.md): Decrypt a JWE token in a request - [JWE Decrypt Plugin Changelog](https://developer.konghq.com/plugins/jwe-decrypt/changelog.md): Decrypt a JWE token in a request - [JWE Decrypt: Inspect specific Key Set](https://developer.konghq.com/plugins/jwe-decrypt/examples/define-key-set.md): Define the Key Set to be inspected by the plugin - [JWE Decrypt Plugin Configuration Reference](https://developer.konghq.com/plugins/jwe-decrypt/reference.md): Decrypt a JWE token in a request - [JWT Signer Plugin](https://developer.konghq.com/plugins/jwt-signer.md): Verify and sign one or two tokens in a request - [JWT Signer Plugin OpenAPI Specification](https://developer.konghq.com/plugins/jwt-signer/api.md): Verify and sign one or two tokens in a request - [JWT Signer Plugin Changelog](https://developer.konghq.com/plugins/jwt-signer/changelog.md): Verify and sign one or two tokens in a request - [JWT Signer: Specify access token introspection claim/property](https://developer.konghq.com/plugins/jwt-signer/examples/access-token-introspection-claim.md): Set up the JWT Signer plugin to verify a claim or property in access token introspection results against the configured scopes required. - [JWT Signer: Disable signing or re-signing tokens](https://developer.konghq.com/plugins/jwt-signer/examples/disable-signing-tokens.md): Disables signing or re-signing access and channel tokens. - [JWT Signer: Enable signing or re-signing tokens](https://developer.konghq.com/plugins/jwt-signer/examples/enable-signing-tokens.md): Enables signing or re-signing access and channel tokens. - [JWT Signer: Validate the not before claim in an access token](https://developer.konghq.com/plugins/jwt-signer/examples/validate-access-token-issuers.md): Validates the "not before" claim in an access token. - [JWT Signer: Validate the issuer claim in a channel token](https://developer.konghq.com/plugins/jwt-signer/examples/validate-channel-token-issuers.md): Validates that the issuer present in a channel token is in the allowed list. - [JWT Signer: Validate the subject claim in a channel token](https://developer.konghq.com/plugins/jwt-signer/examples/validate-channel-token-subjects.md): Validates that the subject present in a channel token is in the allowed list. - [JWT Signer Plugin Configuration Reference](https://developer.konghq.com/plugins/jwt-signer/reference.md): Verify and sign one or two tokens in a request - [JWT Plugin](https://developer.konghq.com/plugins/jwt.md): Verify and authenticate JSON Web Tokens - [JWT Plugin OpenAPI Specification](https://developer.konghq.com/plugins/jwt/api.md): Verify and authenticate JSON Web Tokens - [JWT Plugin Changelog](https://developer.konghq.com/plugins/jwt/changelog.md): Verify and authenticate JSON Web Tokens - [JWT: Include in cookie](https://developer.konghq.com/plugins/jwt/examples/cookie.md): This configuration allows you to specify the JWT token in a cookie. - [JWT: Include in header](https://developer.konghq.com/plugins/jwt/examples/header.md): Allows you to include the JWT in a request to Kong Gateway in the Authorization header. - [JWT: Inspect query string parameters](https://developer.konghq.com/plugins/jwt/examples/query-string.md): This configuration lists query string parameters that Kong Gateway will inspect to retrieve JWTs. - [JWT: Store base64-encoded secret](https://developer.konghq.com/plugins/jwt/examples/store-encoded-secret.md): If your secret contains binary data, you can store it as base64 encoded in Kong Gateway. - [JWT: Verify registered claims](https://developer.konghq.com/plugins/jwt/examples/verified-claim.md): Verify registered claims - [JWT Plugin Configuration Reference](https://developer.konghq.com/plugins/jwt/reference.md): Verify and authenticate JSON Web Tokens - [Kafka Consume Plugin](https://developer.konghq.com/plugins/kafka-consume.md): Consume messages from Kafka topics and make them available through HTTP endpoints - [Kafka Consume Plugin Changelog](https://developer.konghq.com/plugins/kafka-consume/changelog.md): Consume messages from Kafka topics and make them available through HTTP endpoints - [Kafka Consume: Consumer group ID per Kong Gateway Consumer](https://developer.konghq.com/plugins/kafka-consume/examples/consumer-group-kong-consumer.md): Set the Kafka consumer group ID from the authenticated Kong Gateway Consumer's username. - [Kafka Consume: Fixed consumer group ID](https://developer.konghq.com/plugins/kafka-consume/examples/consumer-group-manual.md): Use a fixed, operator-chosen consumer group ID to work with ACL-enforced Kafka clusters. - [Kafka Consume: Filter messages with Lua custom filter code](https://developer.konghq.com/plugins/kafka-consume/examples/filter-messages.md): Configure the Kafka Consume plugin to filter messages with Lua custom filter code. In this example, the Kafka Consume plugin filters by empty values. - [Kafka Consume: HTTP GET](https://developer.konghq.com/plugins/kafka-consume/examples/http-get.md): Configure the Kafka Consume plugin to consume messages via HTTP GET requests. - [Kafka Consume: SASL/OAUTHBEARER authentication](https://developer.konghq.com/plugins/kafka-consume/examples/oauthbearer.md): Authenticate to a Kafka broker using SASL/OAUTHBEARER. Kong Gateway fetches and renews OAuth 2.0 access tokens automatically using the client credentials grant. - [Kafka Consume: Confluent Schema Registry](https://developer.konghq.com/plugins/kafka-consume/examples/schema-registry.md): Configure the Kafka Consume plugin to use the Confluent Schema Registry for message deserialization. - [Kafka Consume: Server-sent events](https://developer.konghq.com/plugins/kafka-consume/examples/server-sent-events.md): Configure the Kafka Consume plugin to stream messages using server-sent events. - [Kafka Consume: Transform messages with Lua custom filter code](https://developer.konghq.com/plugins/kafka-consume/examples/transform-messages.md): Configure the Kafka Consume plugin to transform messages with Lua custom filter code. In this example, the Kafka Consume plugin normalizes messages to a table and decodes them into JSON when possible. - [Kafka Consume Plugin Configuration Reference](https://developer.konghq.com/plugins/kafka-consume/reference.md): Consume messages from Kafka topics and make them available through HTTP endpoints - [Kafka Log Plugin](https://developer.konghq.com/plugins/kafka-log.md): Publish logs to a Kafka topic - [Kafka Log Plugin Changelog](https://developer.konghq.com/plugins/kafka-log/changelog.md): Publish logs to a Kafka topic - [Kafka Log: Compress log messages before sending to Kafka](https://developer.konghq.com/plugins/kafka-log/examples/compress-messages.md): Compress log batches before sending them to the Kafka broker. - [Kafka Log: Delegated tokens authentication](https://developer.konghq.com/plugins/kafka-log/examples/delegation-tokens.md): Use delegated tokens generated in Kafka to authenticate the Kafka Log plugin. - [Kafka Log: Enable mTLS](https://developer.konghq.com/plugins/kafka-log/examples/mtls.md): Encrypts Kafka traffic with mTLS. - [Kafka Log: SASL/OAUTHBEARER authentication](https://developer.konghq.com/plugins/kafka-log/examples/oauthbearer.md): Authenticate to a Kafka broker using SASL/OAUTHBEARER. Kong Gateway fetches and renews OAuth 2.0 access tokens automatically using the client credentials grant. - [Kafka Log: Plain authentication](https://developer.konghq.com/plugins/kafka-log/examples/plain-auth.md): Enables the plain SASL authentication mechanism. - [Kafka Log: Simple JSON encoding for Avro schemas](https://developer.konghq.com/plugins/kafka-log/examples/schema-registry-simple-json.md): Configure the Kafka Log plugin to accept plain JSON for an Avro schema with nullable fields, instead of Avro-encoded JSON with type-tagged unions. - [Kafka Log: Confluent Schema Registry](https://developer.konghq.com/plugins/kafka-log/examples/schema-registry.md): Configure the Kafka Log plugin to use the Confluent Schema Registry for validation and message serialization. - [Kafka Log: SCRAM-SHA-256 authentication](https://developer.konghq.com/plugins/kafka-log/examples/scram-sha-256.md): Enables the SCRAM-SHA-256 SASL authentication mechanism. - [Kafka Log: SCRAM-SHA-512 authentication](https://developer.konghq.com/plugins/kafka-log/examples/scram-sha-512.md): Enables the SCRAM-SHA-512 SASL authentication mechanism. - [Kafka Log: Enable TLS](https://developer.konghq.com/plugins/kafka-log/examples/tls.md): Encrypts Kafka traffic with TLS. - [Kafka Log Plugin Configuration Reference](https://developer.konghq.com/plugins/kafka-log/reference.md): Publish logs to a Kafka topic - [Kafka Upstream Plugin](https://developer.konghq.com/plugins/kafka-upstream.md): Transform requests into Kafka messages in a Kafka topic. - [Kafka Upstream Plugin Changelog](https://developer.konghq.com/plugins/kafka-upstream/changelog.md): Transform requests into Kafka messages in a Kafka topic. - [Kafka Upstream: Compress messages before sending to Kafka](https://developer.konghq.com/plugins/kafka-upstream/examples/compress-messages.md): Compress producer batches before sending them to the Kafka broker. - [Kafka Upstream: Delegated tokens authentication](https://developer.konghq.com/plugins/kafka-upstream/examples/delegation-tokens.md): Use delegated tokens generated in Kafka to authenticate the Kafka Upstream plugin. - [Kafka Upstream: Enable the Kafka Upstream plugin](https://developer.konghq.com/plugins/kafka-upstream/examples/enable.md): Enables the Kafka Upstream plugin. - [Kafka Upstream: Inject consumer info and redact sensitive request headers](https://developer.konghq.com/plugins/kafka-upstream/examples/insert-and-redact.md): Add consumer information and remove sensitive data from request headers.' - [Kafka Upstream: Enable mutual TLS (mTLS)](https://developer.konghq.com/plugins/kafka-upstream/examples/mtls.md): Enable mTLS on Kafka Upstream connections. - [Kafka Upstream: Send messages to multiple topics](https://developer.konghq.com/plugins/kafka-upstream/examples/multiple-producer-topics.md): Send messages to multiple Kafka topics - [Kafka Upstream: SASL/OAUTHBEARER authentication](https://developer.konghq.com/plugins/kafka-upstream/examples/oauthbearer.md): Authenticate to a Kafka broker using SASL/OAUTHBEARER. Kong Gateway fetches and renews OAuth 2.0 access tokens automatically using the client credentials grant. - [Kafka Upstream: Plain authentication](https://developer.konghq.com/plugins/kafka-upstream/examples/plain-auth.md): Enables the plain SASL authentication mechanism. - [Kafka Upstream: Forward HTTP headers as Kafka record headers (allowlist mode)](https://developer.konghq.com/plugins/kafka-upstream/examples/record-headers-allowlist.md): Forward HTTP request headers as Kafka record headers. - [Kafka Upstream: Forward HTTP headers as Kafka record headers (blocklist mode)](https://developer.konghq.com/plugins/kafka-upstream/examples/record-headers-blocklist.md): Forward all HTTP request headers as Kafka record headers, except those on an exclusion list. - [Kafka Upstream: Return a fixed table](https://developer.konghq.com/plugins/kafka-upstream/examples/return-fixed-table.md): The custom function can return any data, as long as the return value is JSON-serializable. Non-serializable values cannot be sent to Kafka. - [Kafka Upstream: Simple JSON encoding for Avro schemas](https://developer.konghq.com/plugins/kafka-upstream/examples/schema-registry-simple-json.md): Configure the Kafka Upstream plugin to accept plain JSON for an Avro schema with nullable fields, instead of Avro-encoded JSON with type-tagged unions. - [Kafka Upstream: Confluent Schema Registry](https://developer.konghq.com/plugins/kafka-upstream/examples/schema-registry.md): Configure the Kafka Upstream plugin to use the Confluent Schema Registry for validation and message serialization. - [Kafka Upstream: SCRAM-SHA-256 authentication](https://developer.konghq.com/plugins/kafka-upstream/examples/scram-sha-256.md): Enables the SCRAM-SHA-256 SASL authentication mechanism. - [Kafka Upstream: SCRAM-SHA-512 authentication](https://developer.konghq.com/plugins/kafka-upstream/examples/scram-sha-512.md): Enables the SCRAM-SHA-512 SASL authentication mechanism. - [Kafka Upstream: Enable TLS](https://developer.konghq.com/plugins/kafka-upstream/examples/tls.md): Enables TLS on Kafka Upstream connections. - [Kafka Upstream: Unmodified message](https://developer.konghq.com/plugins/kafka-upstream/examples/unmodified-message.md): Return a message argument as a return value, so that the function makes no modifications to the default message. - [Kafka Upstream Plugin Configuration Reference](https://developer.konghq.com/plugins/kafka-upstream/reference.md): Transform requests into Kafka messages in a Kafka topic. - [Key Authentication - Encrypted Plugin](https://developer.konghq.com/plugins/key-auth-enc.md): Add key authentication to your services - [Key Authentication - Encrypted Plugin OpenAPI Specification](https://developer.konghq.com/plugins/key-auth-enc/api.md): Add key authentication to your services - [Key Authentication - Encrypted Plugin Changelog](https://developer.konghq.com/plugins/key-auth-enc/changelog.md): Add key authentication to your services - [Key Authentication - Encrypted: Disable a key location](https://developer.konghq.com/plugins/key-auth-enc/examples/disable-key-location.md): This example disables using a key in a query parameter for the Key Auth Encrypted plugin. - [Key Authentication - Encrypted: Enable Key Auth Encrypted](https://developer.konghq.com/plugins/key-auth-enc/examples/enable-key-auth-encrypt.md): This example enables the Key Auth - Encrypted plugin and uses `apikey` for the key name. - [Key Authentication - Encrypted Plugin Configuration Reference](https://developer.konghq.com/plugins/key-auth-enc/reference.md): Add key authentication to your services - [Key Auth Plugin](https://developer.konghq.com/plugins/key-auth.md): Secure Services and Routes with key authentication - [Key Auth Plugin OpenAPI Specification](https://developer.konghq.com/plugins/key-auth/api.md): Secure Services and Routes with key authentication - [Key Auth Plugin Changelog](https://developer.konghq.com/plugins/key-auth/changelog.md): Secure Services and Routes with key authentication - [Key Auth: Disable API key in query parameters](https://developer.konghq.com/plugins/key-auth/examples/disable-key-location.md): This example disables passing the API key through a query parameter when using the Key Auth plugin. - [Key Auth: Enable Key Auth](https://developer.konghq.com/plugins/key-auth/examples/enable-key-auth.md): Enables the Key Auth plugin and sets `apikey` as the key name. - [Key Auth: Realms for external Consumers in Konnect](https://developer.konghq.com/plugins/key-auth/examples/identity-realms.md): Authenticate centrally-managed Consumers in Konnect by configuring the `identity_realms` field in the Key Auth plugin. - [Key Auth: Authenticate principals](https://developer.konghq.com/plugins/key-auth/examples/principals.md): Authenticate principals managed by Kong Identity by configuring the `principals` field in the Key Auth plugin. - [Key Auth Plugin Configuration Reference](https://developer.konghq.com/plugins/key-auth/reference.md): Secure Services and Routes with key authentication - [Kong Response Size Limiting Plugin](https://developer.konghq.com/plugins/kong-response-size-limiting.md): Block responses with bodies greater than a specified size - [Kong Response Size Limiting: Block responses over 128MB](https://developer.konghq.com/plugins/kong-response-size-limiting/examples/payload-with-limit.md): Blocks upstream responses with a body size greater than 128 megabytes. - [Kong Response Size Limiting Plugin Configuration Reference](https://developer.konghq.com/plugins/kong-response-size-limiting/reference.md): Block responses with bodies greater than a specified size - [Kong Service Virtualization Plugin](https://developer.konghq.com/plugins/kong-service-virtualization.md): Mock virtual API request and response pairs through Kong Gateway - [Kong Service Virtualization: Mock request and response pairs](https://developer.konghq.com/plugins/kong-service-virtualization/examples/mock-requests-and-responses.md): Use the Kong Service Virtualization plugin to mock two request-response pairs. - [Kong Service Virtualization Plugin Configuration Reference](https://developer.konghq.com/plugins/kong-service-virtualization/reference.md): Mock virtual API request and response pairs through Kong Gateway - [Kong Spec Expose Plugin](https://developer.konghq.com/plugins/kong-spec-expose.md): Expose OAS/Swagger/etc. specifications of auth protected APIs proxied by Kong - [Kong Spec Expose: Expose OpenAPI spec](https://developer.konghq.com/plugins/kong-spec-expose/examples/expose-spec.md): Expose the OpenAPI specification of an upstream service that is auth-protected by Kong Gateway. - [Kong Spec Expose Plugin Configuration Reference](https://developer.konghq.com/plugins/kong-spec-expose/reference.md): Expose OAS/Swagger/etc. specifications of auth protected APIs proxied by Kong - [Kong Splunk Log Plugin](https://developer.konghq.com/plugins/kong-splunk-log.md): Log API transactions to Splunk using the Splunk HTTP collector - [Kong Splunk Log: Send logs to Splunk](https://developer.konghq.com/plugins/kong-splunk-log/examples/send-logs-to-splunk.md): Configure the Kong Splunk Log plugin to forward request logs to a Splunk instance. - [Kong Splunk Log Plugin Configuration Reference](https://developer.konghq.com/plugins/kong-splunk-log/reference.md): Log API transactions to Splunk using the Splunk HTTP collector - [Kong Upstream JWT Plugin](https://developer.konghq.com/plugins/kong-upstream-jwt.md): Add a signed JWT into the header of proxied requests - [Kong Upstream JWT: Enable JWT in headers](https://developer.konghq.com/plugins/kong-upstream-jwt/examples/enable-jwt-in-headers.md): Enable the Kong Upstream JWT plugin to add a signed JWT into the HTTP Header `JWT` of requests proxied through Kong Gateway. - [Kong Upstream JWT Plugin Configuration Reference](https://developer.konghq.com/plugins/kong-upstream-jwt/reference.md): Add a signed JWT into the header of proxied requests - [LDAP Authentication Advanced Plugin](https://developer.konghq.com/plugins/ldap-auth-advanced.md): Secure Kong with username and password protection, use LDAP search and service directory mapping - [LDAP Authentication Advanced Plugin Changelog](https://developer.konghq.com/plugins/ldap-auth-advanced/changelog.md): Secure Kong with username and password protection, use LDAP search and service directory mapping - [LDAP Authentication Advanced: Authenticate consumers by username](https://developer.konghq.com/plugins/ldap-auth-advanced/examples/authenticate-by-username.md): Configure the plugin to add LDAP authentication and authenticate consumers by username. - [LDAP Authentication Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/ldap-auth-advanced/reference.md): Secure Kong with username and password protection, use LDAP search and service directory mapping - [LDAP Authentication Plugin](https://developer.konghq.com/plugins/ldap-auth.md): Integrate Kong with an LDAP server - [LDAP Authentication Plugin Changelog](https://developer.konghq.com/plugins/ldap-auth/changelog.md): Integrate Kong with an LDAP server - [LDAP Authentication: Authenticate using the LDAPS protocol](https://developer.konghq.com/plugins/ldap-auth/examples/use-ldaps.md): Configure the plugin to perform LDAP authentication over a secure LDAPS connection. - [LDAP Authentication Plugin Configuration Reference](https://developer.konghq.com/plugins/ldap-auth/reference.md): Integrate Kong with an LDAP server - [Loggly Plugin](https://developer.konghq.com/plugins/loggly.md): Send request and response logs to Loggly - [Loggly Plugin Changelog](https://developer.konghq.com/plugins/loggly/changelog.md): Send request and response logs to Loggly - [Loggly: Send data to Loggly](https://developer.konghq.com/plugins/loggly/examples/send-data-to-loggly.md): Configure the plugin to connect to Loggly with the default host and port. - [Loggly Plugin Configuration Reference](https://developer.konghq.com/plugins/loggly/reference.md): Send request and response logs to Loggly - [Metering & Billing Plugin](https://developer.konghq.com/plugins/metering-and-billing.md): A licensed add-on through Konnect Metering & Billing. Meter API requests and AI token usage for usage-based billing. Supports flexible customer identification, custom pricing dimensions, and fine-grained traffic filtering. - [Metering & Billing Plugin Changelog](https://developer.konghq.com/plugins/metering-and-billing/changelog.md): A licensed add-on through Konnect Metering & Billing. Meter API requests and AI token usage for usage-based billing. Supports flexible customer identification, custom pricing dimensions, and fine-grained traffic filtering. - [Metering & Billing: Capture department and project as billing dimensions](https://developer.konghq.com/plugins/metering-and-billing/examples/filter-by-department.md): Attach department and project dimensions from request headers to every usage event. - [Metering & Billing: Meter AI input and output tokens](https://developer.konghq.com/plugins/metering-and-billing/examples/meter-ai-tokens.md): Emit separate usage events for AI input and output tokens on AI Gateway requests, billed to the authenticated Kong Consumer. - [Metering & Billing: Meter API requests by Consumer](https://developer.konghq.com/plugins/metering-and-billing/examples/meter-api-requests.md): Emit a usage event for every API request, billed to the authenticated Kong Gateway Consumer. - [Metering & Billing: Meter API requests by subject header](https://developer.konghq.com/plugins/metering-and-billing/examples/meter-by-tenant-header.md): Identify the billable subject from a request header instead of a Consumer. - [Metering & Billing Plugin Configuration Reference](https://developer.konghq.com/plugins/metering-and-billing/reference.md): A licensed add-on through Konnect Metering & Billing. Meter API requests and AI token usage for usage-based billing. Supports flexible customer identification, custom pricing dimensions, and fine-grained traffic filtering. - [Mocking Plugin](https://developer.konghq.com/plugins/mocking.md): Provide mock endpoints to test your APIs against your Services - [Mocking Plugin Changelog](https://developer.konghq.com/plugins/mocking/changelog.md): Provide mock endpoints to test your APIs against your Services - [Mocking: Mock endpoints using an API spec](https://developer.konghq.com/plugins/mocking/examples/mock-endpoints-using-an-api-spec.md): Configures the Mocking plugin and passes the PetStore API specification. - [Mocking Plugin Configuration Reference](https://developer.konghq.com/plugins/mocking/reference.md): Provide mock endpoints to test your APIs against your Services - [Moesif API Monetization and Analytics Plugin](https://developer.konghq.com/plugins/moesif.md): Powerful API analytics and usage-based billing to monetize APIs - [Moesif API Monetization and Analytics: Enable Moesif](https://developer.konghq.com/plugins/moesif/examples/enable-moesif-plugin.md): Enable the the Moesif plugin by connecting to your Moesif application. - [Moesif API Monetization and Analytics Plugin Configuration Reference](https://developer.konghq.com/plugins/moesif/reference.md): Powerful API analytics and usage-based billing to monetize APIs - [Mutual TLS Authentication Plugin](https://developer.konghq.com/plugins/mtls-auth.md): Secure routes and services with client certificate and mutual TLS authentication - [Mutual TLS Authentication Plugin OpenAPI Specification](https://developer.konghq.com/plugins/mtls-auth/api.md): Secure routes and services with client certificate and mutual TLS authentication - [Mutual TLS Authentication Plugin Changelog](https://developer.konghq.com/plugins/mtls-auth/changelog.md): Secure routes and services with client certificate and mutual TLS authentication - [Mutual TLS Authentication: Enable MTLS authentication](https://developer.konghq.com/plugins/mtls-auth/examples/enable-mtls.md): Configure the plugin with a CA Certificate to enable mutual TLS authentication. - [Mutual TLS Authentication Plugin Configuration Reference](https://developer.konghq.com/plugins/mtls-auth/reference.md): Secure routes and services with client certificate and mutual TLS authentication - [Noma Runtime Protection Plugin](https://developer.konghq.com/plugins/noma-runtime-protection.md): AI-DR runtime protection for all OpenAI-compliant modules through your Kong AI Gateway - [Noma Runtime Protection: Enable Noma Runtime Protection](https://developer.konghq.com/plugins/noma-runtime-protection/examples/enable-noma-runtime-protection.md): Enable the Noma Runtime Protection plugin. - [Noma Runtime Protection Plugin Configuration Reference](https://developer.konghq.com/plugins/noma-runtime-protection/reference.md): AI-DR runtime protection for all OpenAI-compliant modules through your Kong AI Gateway - [OAS Validation Plugin](https://developer.konghq.com/plugins/oas-validation.md): Validate HTTP requests and responses based on an OpenAPI 3.0 or Swagger API Specification - [OAS Validation Plugin Changelog](https://developer.konghq.com/plugins/oas-validation/changelog.md): Validate HTTP requests and responses based on an OpenAPI 3.0 or Swagger API Specification - [OAS Validation: Enable structured validation errors](https://developer.konghq.com/plugins/oas-validation/examples/structured-errors.md): Return validation errors as a structured list instead of a flat string. - [OAS Validation: Upload spec for validation](https://developer.konghq.com/plugins/oas-validation/examples/validate-oas.md): Upload an API spec to validate requests against. - [OAS Validation Plugin Configuration Reference](https://developer.konghq.com/plugins/oas-validation/reference.md): Validate HTTP requests and responses based on an OpenAPI 3.0 or Swagger API Specification - [OAuth 2.0 Introspection Plugin](https://developer.konghq.com/plugins/oauth2-introspection.md): Integrate Kong Gateway with a third-party OAuth 2.0 Authorization Server - [OAuth 2.0 Introspection Plugin Changelog](https://developer.konghq.com/plugins/oauth2-introspection/changelog.md): Integrate Kong Gateway with a third-party OAuth 2.0 Authorization Server - [OAuth 2.0 Introspection: Kong Identity](https://developer.konghq.com/plugins/oauth2-introspection/examples/kong-identity.md): Configure the plugin to use a Kong Identity auth server's introspection endpoint to validate an access token. - [OAuth 2.0 Introspection: Validate an access token](https://developer.konghq.com/plugins/oauth2-introspection/examples/validate-access-token.md): Configure the plugin to use an OAuth 2.0 server's introspection endpoint to validate an access token. - [OAuth 2.0 Introspection Plugin Configuration Reference](https://developer.konghq.com/plugins/oauth2-introspection/reference.md): Integrate Kong Gateway with a third-party OAuth 2.0 Authorization Server - [OAuth 2.0 Authentication Plugin](https://developer.konghq.com/plugins/oauth2.md): Add OAuth 2.0 authentication to your Services and Routes - [OAuth 2.0 Authentication Plugin OpenAPI Specification](https://developer.konghq.com/plugins/oauth2/api.md): Add OAuth 2.0 authentication to your Services and Routes - [OAuth 2.0 Authentication Plugin Changelog](https://developer.konghq.com/plugins/oauth2/changelog.md): Add OAuth 2.0 authentication to your Services and Routes - [OAuth 2.0 Authentication: Enable the plugin for the Client Credentials flow](https://developer.konghq.com/plugins/oauth2/examples/client-credentials.md): Configure the plugin to enable the Client Credentials OAuth 2.0 flow - [OAuth 2.0 Authentication Plugin Configuration Reference](https://developer.konghq.com/plugins/oauth2/reference.md): Add OAuth 2.0 authentication to your Services and Routes - [OPA Plugin](https://developer.konghq.com/plugins/opa.md): Authorize requests against Open Policy Agent - [OPA Plugin Changelog](https://developer.konghq.com/plugins/opa/changelog.md): Authorize requests against Open Policy Agent - [OPA: Custom OPA host and port](https://developer.konghq.com/plugins/opa/examples/custom-host-and-port.md): Configure the OPA plugin to connect to an OPA server with a custom host and port and get a policy. - [OPA Plugin Configuration Reference](https://developer.konghq.com/plugins/opa/reference.md): Authorize requests against Open Policy Agent - [OpenID Connect Plugin](https://developer.konghq.com/plugins/openid-connect.md): Integrate Kong Gateway with a third-party OpenID Connect provider - [OpenID Connect Plugin OpenAPI Specification](https://developer.konghq.com/plugins/openid-connect/api.md): Integrate Kong Gateway with a third-party OpenID Connect provider - [OpenID Connect Plugin Changelog](https://developer.konghq.com/plugins/openid-connect/changelog.md): Integrate Kong Gateway with a third-party OpenID Connect provider - [OpenID Connect: ACL plugin authorization](https://developer.konghq.com/plugins/openid-connect/examples/acl-auth.md): Configure the OpenID Connect plugin for ACL-based authorization. - [OpenID Connect: OpenID Connect with Amazon Cognito](https://developer.konghq.com/plugins/openid-connect/examples/amazon-cognito.md): Configure the OpenID Connect plugin with Amazon Cognito User Pools. - [OpenID Connect: OpenID Connect with Auth0](https://developer.konghq.com/plugins/openid-connect/examples/auth0.md): Authenticate headless service consumers using Auth0's identity provider. - [OpenID Connect: Authorization code flow](https://developer.konghq.com/plugins/openid-connect/examples/authorization-code.md): This example configures the OpenID Connect plugin with an authorization code flow. - [OpenID Connect: OpenID Connect with Azure AD](https://developer.konghq.com/plugins/openid-connect/examples/azure-ad.md): Authenticate browser clients using an Azure AD identity provider. - [OpenID Connect: Cert-bound access tokens without client secret or ID](https://developer.konghq.com/plugins/openid-connect/examples/cert-bound-access-tokens-no-client-info.md): Configure the OpenID Connect plugin wih TLS Handshake Modifier to use certificate-bound access tokens without a client secret or ID. - [OpenID Connect: Cert-bound access tokens](https://developer.konghq.com/plugins/openid-connect/examples/cert-bound-access-tokens.md): Configure the OpenID Connect plugin to use certificate-bound access tokens. - [OpenID Connect: Claims-based authorization](https://developer.konghq.com/plugins/openid-connect/examples/claims-based-auth.md): Configure the OpenID Connect plugin for claims-based authorization. - [OpenID Connect: Client credentials grant in header with Kong Identity](https://developer.konghq.com/plugins/openid-connect/examples/client-credentials-identity.md): Configure the OpenID Connect plugin with the client credentials grant using a Kong Identity Authentication server. - [OpenID Connect: Client credentials grant in header](https://developer.konghq.com/plugins/openid-connect/examples/client-credentials.md): Configure the OpenID Connect plugin with the client credentials grant. - [OpenID Connect: Consumer authorization](https://developer.konghq.com/plugins/openid-connect/examples/consumer-auth.md): Configure Consumer mapping with the OpenID Connect plugin. - [OpenID Connect: Consumer Group authorization](https://developer.konghq.com/plugins/openid-connect/examples/consumer-group-auth.md): Configure Consumer Group mapping with the OpenID Connect plugin. - [OpenID Connect: OpenID Connect with Curity](https://developer.konghq.com/plugins/openid-connect/examples/curity.md): Integrate Kong Gateway and the Curity Identity Server for introspection using the Phantom Token pattern. - [OpenID Connect: Demonstrating Proof-of-Possession (DPoP)](https://developer.konghq.com/plugins/openid-connect/examples/dpop.md): Configure the OpenID Connect plugin for Demonstrating Proof-of-Possession (DPoP). - [OpenID Connect: Token validation for multiple IdPs](https://developer.konghq.com/plugins/openid-connect/examples/extra-jwks.md): Configure the OpenID Connect plugin to validate JWTs issued by multiple IdPs. - [OpenID Connect: OpenID Connect with Google](https://developer.konghq.com/plugins/openid-connect/examples/google.md): Authenticate browser clients using Google's identity provider. - [OpenID Connect: Passing metadata in headers](https://developer.konghq.com/plugins/openid-connect/examples/headers.md): The OpenID Connect plugin can pass claim values, tokens, JWKs, and the session identifier to the upstream service in request headers, and to the downstream client in response headers. - [OpenID Connect: Introspection authentication](https://developer.konghq.com/plugins/openid-connect/examples/introspection-auth.md): Configure the OpenID Connect plugin with introspection authentication. - [OpenID Connect: JWT access token authentication](https://developer.konghq.com/plugins/openid-connect/examples/jwt-access-token.md): Configure the OpenID Connect plugin with JWT access token authentication. - [OpenID Connect: Kong OAuth token authentication](https://developer.konghq.com/plugins/openid-connect/examples/kong-oauth-token.md): Configure the OpenID Connect plugin to verify the tokens issued by Kong OAuth 2.0 plugin. - [OpenID Connect: Session logout](https://developer.konghq.com/plugins/openid-connect/examples/logout.md): Configure the OpenID Connect plugin with the ability for users to log out of their sessions. - [OpenID Connect: Mutual TLS client authentication](https://developer.konghq.com/plugins/openid-connect/examples/mtls-client-auth.md): Configure the OpenID Connect plugin to use mutual TLS (mTLS) client authentication. - [OpenID Connect: mTLS Proof-of-Possession with certificate in header](https://developer.konghq.com/plugins/openid-connect/examples/mtls-pop-from-header.md): Configure the OpenID Connect plugin for mTLS Proof-of-Possession (PoP) validation when the client certificate is injected via an HTTP header by a WAF or L7 proxy. - [OpenID Connect: OpenID Connect with Okta](https://developer.konghq.com/plugins/openid-connect/examples/okta.md): Authenticate browser clients using Okta. - [OpenID Connect: Use a custom JWKS endpoint for discovery](https://developer.konghq.com/plugins/openid-connect/examples/override-jwks-endpoint.md): Set a custom JWKS endpoint for the OpenID Connect plugin to use instead of the one returned by the internal discovery mechanism. - [OpenID Connect: Password grant](https://developer.konghq.com/plugins/openid-connect/examples/password.md): Configure the OpenID Connect plugin to use the legacy password grant. - [OpenID Connect: Protected resource metadata](https://developer.konghq.com/plugins/openid-connect/examples/protected-resource-metadata.md): Use the OpenID Connect plugin to advertise this API as an OAuth 2.0 protected resource per RFC 9728. - [OpenID Connect: Refresh token grant](https://developer.konghq.com/plugins/openid-connect/examples/refresh-token.md): Configure the OpenID Connect plugin to use the refresh token grant. - [OpenID Connect: Session authentication](https://developer.konghq.com/plugins/openid-connect/examples/session-auth.md): Configure the OpenID Connect plugin to issue session cookies that can be used for further session authentication. - [OpenID Connect: Token exchange with an actor token](https://developer.konghq.com/plugins/openid-connect/examples/token-exchange-actor-token.md): Use the OpenID Connect plugin to include an actor token in a token exchange request. - [OpenID Connect: Token exchange for cross-domain security](https://developer.konghq.com/plugins/openid-connect/examples/token-exchange-cross-domain.md): Use the OpenID Connect plugin to exchange tokens between different authorization servers. - [OpenID Connect: Token transformation](https://developer.konghq.com/plugins/openid-connect/examples/token-exchange-transformation.md): Use the OpenID Connect plugin to switch an external token with limited scope for an internal token with necessary scope. - [OpenID Connect: User info authentication](https://developer.konghq.com/plugins/openid-connect/examples/user-info-auth.md): Configure the OpenID Connect plugin to use user info authentication. - [OpenID Connect Plugin Configuration Reference](https://developer.konghq.com/plugins/openid-connect/reference.md): Integrate Kong Gateway with a third-party OpenID Connect provider - [OpenTelemetry Plugin](https://developer.konghq.com/plugins/opentelemetry.md): Propagate spans and report space to a backend server through OTLP protocol. - [OpenTelemetry Plugin Changelog](https://developer.konghq.com/plugins/opentelemetry/changelog.md): Propagate spans and report space to a backend server through OTLP protocol. - [OpenTelemetry: Add custom attributes to your access logs](https://developer.konghq.com/plugins/opentelemetry/examples/custom-access-logs.md): Add custom attributes to your access logs using the OpenTelemetry plugin. - [OpenTelemetry: Enable the OTEL plugin for metrics, traces and logs](https://developer.konghq.com/plugins/opentelemetry/examples/enable-otel.md): Enables the OTEL plugin with an endpoint for metrics, tracing and logs. - [OpenTelemetry: Extract, clear, and inject](https://developer.konghq.com/plugins/opentelemetry/examples/extract-clear-inject.md): Configure the OpenTelemetry plugin to extract tracing context, clear specific headers, and inject tracing context using a specific format. - [OpenTelemetry: Ignore incoming headers](https://developer.konghq.com/plugins/opentelemetry/examples/ignore-incoming-headers.md): Configure the OpenTelemetry plugin to inject tracing context in multiple formats. - [OpenTelemetry: Add Principal attributes to metrics](https://developer.konghq.com/plugins/opentelemetry/examples/metrics-principal-attributes.md): Add authenticated Principal attributes to the OTEL plugin's request count and bandwidth metrics. - [OpenTelemetry: Enable the OTEL plugin for metrics](https://developer.konghq.com/plugins/opentelemetry/examples/metrics.md): Configures the OTEL plugin to push metrics every 10 seconds, - [OpenTelemetry: Multiple injection](https://developer.konghq.com/plugins/opentelemetry/examples/multiple-injection.md): Configure the OpenTelemetry plugin to extract tracing context in one format and inject tracing context in multiple formats. - [OpenTelemetry: Preserve incoming format](https://developer.konghq.com/plugins/opentelemetry/examples/preserve-incoming-format.md): Configure the OpenTelemetry plugin to extract and preserve the tracing context in the same header type. - [OpenTelemetry: Enable the OTEL plugin for runtime logs](https://developer.konghq.com/plugins/opentelemetry/examples/runtime-logs.md): Enables the OTEL plugin with an endpoint for logs about the data plane's internal execution. - [OpenTelemetry: Enable the OTEL plugin for traces](https://developer.konghq.com/plugins/opentelemetry/examples/traces.md): Enables the OTEL plugin with an endpoint for traces. - [OpenTelemetry: Enable the OTEL plugin for transactional logs](https://developer.konghq.com/plugins/opentelemetry/examples/transactional-logs.md): Enables the OTEL plugin with an endpoint for API transactional logs. - [OpenTelemetry Plugin Configuration Reference](https://developer.konghq.com/plugins/opentelemetry/reference.md): Propagate spans and report space to a backend server through OTLP protocol. - [Palo Alto Networks API Security Plugin](https://developer.konghq.com/plugins/panw-apisec-http-log.md): Enhance your API security by integrating your Kong Gateway with Cortex API Security - [Palo Alto Networks API Security: Enable Palo Alto Networks API Security](https://developer.konghq.com/plugins/panw-apisec-http-log/examples/enable-panw-apisec-httplog.md): Enable the Palo Alto Networks API Security plugin. - [Palo Alto Networks API Security Plugin Configuration Reference](https://developer.konghq.com/plugins/panw-apisec-http-log/reference.md): Enhance your API security by integrating your Kong Gateway with Cortex API Security - [Post-Function Plugin](https://developer.konghq.com/plugins/post-function.md): Add and manage custom Lua functions to execute after other plugins - [Post-Function Plugin Changelog](https://developer.konghq.com/plugins/post-function/changelog.md): Add and manage custom Lua functions to execute after other plugins - [Post-Function: Disable headers from being passed to upstream service](https://developer.konghq.com/plugins/post-function/examples/disable-headers-in-access-phase.md): Pass Lua code as a string to the Post-Function plugin. - [Post-Function: Pass Lua code as files and run in multiple phase](https://developer.konghq.com/plugins/post-function/examples/run-in-multiple-phases.md): Run the Post-Function plugin in multiple phases. - [Post-Function Plugin Configuration Reference](https://developer.konghq.com/plugins/post-function/reference.md): Add and manage custom Lua functions to execute after other plugins - [Pre-Function Plugin](https://developer.konghq.com/plugins/pre-function.md): Add and manage custom Lua functions to run before other plugins - [Pre-Function Plugin Changelog](https://developer.konghq.com/plugins/pre-function/changelog.md): Add and manage custom Lua functions to run before other plugins - [Pre-Function: Add a header to a request based on another header](https://developer.konghq.com/plugins/pre-function/examples/add-header-to-request.md): Use Lua code to check for the existence of a header in a request, and if that header exists, add a new header with the same value. - [Pre-Function: Pass Lua code as string](https://developer.konghq.com/plugins/pre-function/examples/run-in-access-phase.md): Pass Lua code as a string to the Pre-Function plugin. - [Pre-Function: Pass Lua code as files and run in multiple phase](https://developer.konghq.com/plugins/pre-function/examples/run-in-multiple-phases.md): Run the Pre-Function plugin in multiple phases. - [Pre-Function Plugin Configuration Reference](https://developer.konghq.com/plugins/pre-function/reference.md): Add and manage custom Lua functions to run before other plugins - [Prisma AI Runtime Security (AIRS) API Intercept Plugin](https://developer.konghq.com/plugins/prisma-airs-intercept.md): Real-time security scanning for AI/LLM traffic using PAN Prisma AI Runtime Security - [Prisma AI Runtime Security (AIRS) API Intercept: Enable Prisma AIRS API Intercept](https://developer.konghq.com/plugins/prisma-airs-intercept/examples/enable-prisma-airs-intercept.md): Enable the Prisma AI Runtime Security (AIRS) API Intercept plugin in Kong Gateway to scan API chat completions traffic for threats. - [Prisma AI Runtime Security (AIRS) API Intercept Plugin Configuration Reference](https://developer.konghq.com/plugins/prisma-airs-intercept/reference.md): Real-time security scanning for AI/LLM traffic using PAN Prisma AI Runtime Security - [Prometheus Plugin](https://developer.konghq.com/plugins/prometheus.md): Expose metrics related to Kong Gateway and proxied upstream services in Prometheus exposition format - [Prometheus Plugin OpenAPI Specification](https://developer.konghq.com/plugins/prometheus/api.md): Expose metrics related to Kong Gateway and proxied upstream services in Prometheus exposition format - [Prometheus Plugin Changelog](https://developer.konghq.com/plugins/prometheus/changelog.md): Expose metrics related to Kong Gateway and proxied upstream services in Prometheus exposition format - [Prometheus: Collect per-Consumer metrics](https://developer.konghq.com/plugins/prometheus/examples/collect-consumer-metrics.md): Collects per-Consumer metrics. - [Prometheus Plugin Configuration Reference](https://developer.konghq.com/plugins/prometheus/reference.md): Expose metrics related to Kong Gateway and proxied upstream services in Prometheus exposition format - [Proxy Caching Advanced Plugin](https://developer.konghq.com/plugins/proxy-cache-advanced.md): Cache and serve commonly requested responses in Kong, in-memory or using Redis - [Proxy Caching Advanced Plugin OpenAPI Specification](https://developer.konghq.com/plugins/proxy-cache-advanced/api.md): Cache and serve commonly requested responses in Kong, in-memory or using Redis - [Proxy Caching Advanced Plugin Changelog](https://developer.konghq.com/plugins/proxy-cache-advanced/changelog.md): Cache and serve commonly requested responses in Kong, in-memory or using Redis - [Proxy Caching Advanced: Cache by Principal](https://developer.konghq.com/plugins/proxy-cache-advanced/examples/cache-by-principal.md): Cache responses to GET requests using the authenticated Principal to compose the cache key. - [Proxy Caching Advanced: Cache responses to successful GET requests](https://developer.konghq.com/plugins/proxy-cache-advanced/examples/cache-get-responses.md): Cache responses to GET requests with a 200 response code for 300 seconds before renewing the cache. - [Proxy Caching Advanced: Cache responses with Redis](https://developer.konghq.com/plugins/proxy-cache-advanced/examples/redis-strategy.md): Cache responses to GET requests with a 200 response code in Redis. - [Proxy Caching Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/proxy-cache-advanced/reference.md): Cache and serve commonly requested responses in Kong, in-memory or using Redis - [Proxy Cache Plugin](https://developer.konghq.com/plugins/proxy-cache.md): Cache and serve commonly requested responses in Kong - [Proxy Cache Plugin OpenAPI Specification](https://developer.konghq.com/plugins/proxy-cache/api.md): Cache and serve commonly requested responses in Kong - [Proxy Cache Plugin Changelog](https://developer.konghq.com/plugins/proxy-cache/changelog.md): Cache and serve commonly requested responses in Kong - [Proxy Cache: Cache by Principal](https://developer.konghq.com/plugins/proxy-cache/examples/cache-by-principal.md): Cache responses to GET requests using the authenticated Principal to compose the cache key. - [Proxy Cache: Cache responses to successful GET requests](https://developer.konghq.com/plugins/proxy-cache/examples/cache-get-responses.md): Cache responses to GET requests with a 200 response code for 300 seconds before renewing the cache. - [Proxy Cache Plugin Configuration Reference](https://developer.konghq.com/plugins/proxy-cache/reference.md): Cache and serve commonly requested responses in Kong - [Rate Limiting Advanced Plugin](https://developer.konghq.com/plugins/rate-limiting-advanced.md): Enhanced rate limiting capabilities such as sliding window support, Redis Sentinel support, and increased performance - [Rate Limiting Advanced Plugin Changelog](https://developer.konghq.com/plugins/rate-limiting-advanced/changelog.md): Enhanced rate limiting capabilities such as sliding window support, Redis Sentinel support, and increased performance - [Rate Limiting Advanced: Fixed window 200 reqs per 30 mins](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/fixed-window-200-requests-per-30-min.md): Users are allowed 200 requests per 30 minutes, resetting exactly on the 30 minute mark with no carryover of unused limits. - [Rate Limiting Advanced: Fixed window 500 reqs per hour](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/fixed-window-500-requests-per-hour.md): A fixed limit of 500 requests per hour resetting sharply on the hour, ensuring no user can exceed this limit. - [Rate Limiting Advanced: Fixed window 5000 reqs per day](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/fixed-window-5000-requests-per-day.md): A strict limit of 5000 requests per day resetting promptly at midnight, preventing any burst traffic or inconsistent user experiences. - [Rate Limiting Advanced: Rate limit by Principal metadata](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/rate-limit-by-principal-metadata.md): Rate limit by Principal, with the limit and rate limiting key both driven by CEL expressions reading the Principal's metadata. - [Rate Limiting Advanced: Rate limit by consumer username](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/rate-limit-counter-key.md): Rate limits consumers based on their username. By default, when `identifier` is set to `consumer`, counters are keyed by `consumer.id`. Setting `counter_key` to `consumer.username` keys the counter by username instead, so consumers with the same username share a single rate limit counter regardless of which control plane processed the request. This is useful in distributed deployments where consumers with the same username exist across multiple control planes but should be subject to a unified rate limit. - [Rate Limiting Advanced: Sliding window 100 reqs per hour](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/sliding-window-100-requests-per-hour.md): Each user can make up to 100 requests every rolling hour, with the plugin continuously adjusting the count over the course of the hour. There is no hard limit or known reset. - [Rate Limiting Advanced: Sliding window 300 reqs per 30 mins](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/sliding-window-300-requests-per-30-min.md): Each user can make up to 300 requests in any rolling 30 minute period, with the plugin continuously adjusting the count as new requests are made. - [Rate Limiting Advanced: Sliding window 500 reqs per hour](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/sliding-window-500-requests-per-hour.md): Each user is allowed 500 requests every rolling hour. If the limit is exceeded and the user receives a 429 error, each additional request within the sliding window (hour) will extend the wait time by about 12 minutes, continuously adjusting as new requests are made. - [Rate Limiting Advanced: Throttle requests](https://developer.konghq.com/plugins/rate-limiting-advanced/examples/throttle-requests.md): Allows requests that exceed the rate limit threshold to be delayed and retried, rather than immediately rejected with a 429 status code. - [Rate Limiting Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/rate-limiting-advanced/reference.md): Enhanced rate limiting capabilities such as sliding window support, Redis Sentinel support, and increased performance - [Rate Limiting Plugin](https://developer.konghq.com/plugins/rate-limiting.md): You can use the Rate Limiting plugin to limit how many HTTP requests can be made in a given period of seconds, minutes, hours, days, months, or years. - [Rate Limiting Plugin Changelog](https://developer.konghq.com/plugins/rate-limiting/changelog.md): You can use the Rate Limiting plugin to limit how many HTTP requests can be made in a given period of seconds, minutes, hours, days, months, or years. - [Rate Limiting: Rate limit by Principal metadata](https://developer.konghq.com/plugins/rate-limiting/examples/rate-limit-by-principal-metadata.md): Rate limit by Principal, with the limit and rate limiting key both driven by CEL expressions reading the Principal's metadata. - [Rate Limiting: Rate limiting with local policy](https://developer.konghq.com/plugins/rate-limiting/examples/rate-limit-with-local-policy.md): Users are allowed either 5 requests per second, or 1000 requests per hour. The local policy stores counters in-memory on the node. - [Rate Limiting Plugin Configuration Reference](https://developer.konghq.com/plugins/rate-limiting/reference.md): You can use the Rate Limiting plugin to limit how many HTTP requests can be made in a given period of seconds, minutes, hours, days, months, or years. - [Redirect Plugin](https://developer.konghq.com/plugins/redirect.md): Redirect incoming requests to a new URL - [Redirect Plugin Changelog](https://developer.konghq.com/plugins/redirect/changelog.md): Redirect incoming requests to a new URL - [Redirect: Keep the incoming request path](https://developer.konghq.com/plugins/redirect/examples/redirect-with-incoming-path.md): Redirect incoming requests to a target location, using the request path and query string from the incoming request in the redirect URL. - [Redirect: Use a static URL](https://developer.konghq.com/plugins/redirect/examples/redirect-with-static-path.md): Redirect incoming requests to a target location, using the request path and query string from the configuration in the redirect URL. - [Redirect Plugin Configuration Reference](https://developer.konghq.com/plugins/redirect/reference.md): Redirect incoming requests to a new URL - [Request Callout Plugin](https://developer.konghq.com/plugins/request-callout.md): Insert arbitrary API calls before proxying a request to the upstream service. - [Request Callout Plugin Changelog](https://developer.konghq.com/plugins/request-callout/changelog.md): Insert arbitrary API calls before proxying a request to the upstream service. - [Request Callout: Build a response from multiple APIs](https://developer.konghq.com/plugins/request-callout/examples/build-response-from-multiple-apis.md): Configure the Request Callout plugin to call multiple APIs and build a response with elements from different responses. - [Request Callout: Cache the request results](https://developer.konghq.com/plugins/request-callout/examples/cache-request-result.md): Configure the Request Callout plugin to cache the results of the request. - [Request Callout: Customize a cache key](https://developer.konghq.com/plugins/request-callout/examples/customize-cache-key.md): Configure the Request Callout plugin to cache response results in Redis with a custom key. - [Request Callout: Dynamically change the request URL via dynamic URL expression](https://developer.konghq.com/plugins/request-callout/examples/dynamic-url-via-expressions.md): Configure the plugin to send a request to a different URL based on a header value. - [Request Callout: Dynamically change the request URL via `request.by_lua` Lua code](https://developer.konghq.com/plugins/request-callout/examples/dynamic-url-via-lua-code.md): Configure the plugin to send a request to a different URL based on a header value. - [Request Callout: Send a request containing form data](https://developer.konghq.com/plugins/request-callout/examples/form-urlencoded-request.md): Configure the Request Callout plugin to send a request in the `x-www-form-urlencoded` format. - [Request Callout: Request a token and insert it in a request](https://developer.konghq.com/plugins/request-callout/examples/request-and-insert-token.md): Configure the Request Callout plugin to send a request to an API to get a token, then use the token in the request to the upstream server. - [Request Callout: Retry failed requests](https://developer.konghq.com/plugins/request-callout/examples/retry-failed-requests.md): Configure the Request Callout plugin to retry sending requests if requests fail, then return a custom error message and status code. - [Request Callout Plugin Configuration Reference](https://developer.konghq.com/plugins/request-callout/reference.md): Insert arbitrary API calls before proxying a request to the upstream service. - [Request Size Limiting Plugin](https://developer.konghq.com/plugins/request-size-limiting.md): Block requests with bodies greater than a specified size - [Request Size Limiting Plugin Changelog](https://developer.konghq.com/plugins/request-size-limiting/changelog.md): Block requests with bodies greater than a specified size - [Request Size Limiting: Limit request size in bytes](https://developer.konghq.com/plugins/request-size-limiting/examples/limit-in-bytes.md): Limit the size of incoming request payloads to a specific number of bytes. - [Request Size Limiting: Limit request size in kilobytes](https://developer.konghq.com/plugins/request-size-limiting/examples/limit-in-kb.md): Limit the size of incoming request payloads to a specific number of kilobytes. - [Request Size Limiting: Limit request size in megabytes](https://developer.konghq.com/plugins/request-size-limiting/examples/limit-in-mb.md): Limit the size of incoming request payloads to a specific number of megabytes (default size unit). - [Request Size Limiting Plugin Configuration Reference](https://developer.konghq.com/plugins/request-size-limiting/reference.md): Block requests with bodies greater than a specified size - [Request Termination Plugin](https://developer.konghq.com/plugins/request-termination.md): Terminates all requests with a specific response - [Request Termination Plugin Changelog](https://developer.konghq.com/plugins/request-termination/changelog.md): Terminates all requests with a specific response - [Request Termination: Block requests with an error message](https://developer.konghq.com/plugins/request-termination/examples/block-requests-with-error.md): Block requests with a 401 status code and a custom message. - [Request Termination: Echo response back to client](https://developer.konghq.com/plugins/request-termination/examples/echo-response-to-client.md): Block requests and echo the response back to the client with debugging information about the Kong Gateway instance, such as the matched Route and Gateway Service. - [Request Termination: Trigger plugin on header](https://developer.konghq.com/plugins/request-termination/examples/trigger-on-header.md): Block requests if a specific header exists in the request. - [Request Termination Plugin Configuration Reference](https://developer.konghq.com/plugins/request-termination/reference.md): Terminates all requests with a specific response - [Request Transformer Advanced Plugin](https://developer.konghq.com/plugins/request-transformer-advanced.md): Use powerful regular expressions, variables, and templates to transform API requests - [Request Transformer Advanced Plugin Changelog](https://developer.konghq.com/plugins/request-transformer-advanced/changelog.md): Use powerful regular expressions, variables, and templates to transform API requests - [Request Transformer Advanced: Replace the URI using capturing groups](https://developer.konghq.com/plugins/request-transformer-advanced/examples/replace-uri.md): Configure the plugin to replace the request URI using a capture group in the original URI before proxying the request to the upstream server. - [Request Transformer Advanced: Transform multiple request elements](https://developer.konghq.com/plugins/request-transformer-advanced/examples/transform-multiple-request-elements.md): Configure the plugin to perform the following transformations on the request before proxying to the upstream server. - [Request Transformer Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/request-transformer-advanced/reference.md): Use powerful regular expressions, variables, and templates to transform API requests - [Request Transformer Plugin](https://developer.konghq.com/plugins/request-transformer.md): Use regular expressions, variables, and templates to transform requests - [Request Transformer Plugin Changelog](https://developer.konghq.com/plugins/request-transformer/changelog.md): Use regular expressions, variables, and templates to transform requests - [Request Transformer: Add a new header](https://developer.konghq.com/plugins/request-transformer/examples/add-header.md): Configure the plugin to add a new header to the request before proxying it to the upstream server. - [Request Transformer: Append and remove](https://developer.konghq.com/plugins/request-transformer/examples/append-and-remove.md): Configure the plugin to append a query parameter and remove a header from the request before proxying it to the upstream server. - [Request Transformer: Rewrite a path](https://developer.konghq.com/plugins/request-transformer/examples/rewrite-path.md): Configure the plugin to rewrite the request path before proxying it to the upstream. - [Request Transformer Plugin Configuration Reference](https://developer.konghq.com/plugins/request-transformer/reference.md): Use regular expressions, variables, and templates to transform requests - [Request Validator Plugin](https://developer.konghq.com/plugins/request-validator.md): Validates requests before they reach the upstream service - [Request Validator Plugin Changelog](https://developer.konghq.com/plugins/request-validator/changelog.md): Validates requests before they reach the upstream service - [Request Validator: Log invalid requests without blocking](https://developer.konghq.com/plugins/request-validator/examples/tap-mode.md): Run the Request Validator plugin in tap mode. - [Request Validator: Validate a request path](https://developer.konghq.com/plugins/request-validator/examples/validate-path-parameter.md): Configure the Request Validator plugin to check that the request path contains a status code parameter with a number value. - [Request Validator: Validate a request body](https://developer.konghq.com/plugins/request-validator/examples/validate-request-body.md): Configure the Request Validator plugin to check that the request body contains a name field with a string value. - [Request Validator Plugin Configuration Reference](https://developer.konghq.com/plugins/request-validator/reference.md): Validates requests before they reach the upstream service - [Response Rate Limiting Plugin](https://developer.konghq.com/plugins/response-ratelimiting.md): Rate limit based on a custom response header value. - [Response Rate Limiting Plugin Changelog](https://developer.konghq.com/plugins/response-ratelimiting/changelog.md): Rate limit based on a custom response header value. - [Response Rate Limiting: Response rate limit with local policy](https://developer.konghq.com/plugins/response-ratelimiting/examples/response-rate-limit-with-local-policy.md): Configure a custom response limit with 10 responses allowed per minute. - [Response Rate Limiting Plugin Configuration Reference](https://developer.konghq.com/plugins/response-ratelimiting/reference.md): Rate limit based on a custom response header value. - [Response Transformer Advanced Plugin](https://developer.konghq.com/plugins/response-transformer-advanced.md): Modify the upstream response before returning it to the client, with greater customization capabilities - [Response Transformer Advanced Plugin Changelog](https://developer.konghq.com/plugins/response-transformer-advanced/changelog.md): Modify the upstream response before returning it to the client, with greater customization capabilities - [Response Transformer Advanced: Remove nested JSON content](https://developer.konghq.com/plugins/response-transformer-advanced/examples/remove-nested-json.md): Configure the plugin to remove a nested JSON property. - [Response Transformer Advanced: Replace the JSON body](https://developer.konghq.com/plugins/response-transformer-advanced/examples/replace-json-body.md): Configure the plugin to replace the entire JSON body for 500 responses. - [Response Transformer Advanced: Transform the JSON body with a Lua function](https://developer.konghq.com/plugins/response-transformer-advanced/examples/transform-json-body-with-lua-function.md): Configure the plugin to use a Lua function to transform the response body. - [Response Transformer Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/response-transformer-advanced/reference.md): Modify the upstream response before returning it to the client, with greater customization capabilities - [Response Transformer Plugin](https://developer.konghq.com/plugins/response-transformer.md): Modify the upstream response before returning it to the client - [Response Transformer Plugin Changelog](https://developer.konghq.com/plugins/response-transformer/changelog.md): Modify the upstream response before returning it to the client - [Response Transformer: Add a new header](https://developer.konghq.com/plugins/response-transformer/examples/add-header.md): Configure the plugin to add a new header to the response before returning it to the client. - [Response Transformer: Remove a JSON property](https://developer.konghq.com/plugins/response-transformer/examples/remove-json-properties.md): Configure the plugin to remove a custom JSON property from the response before returning it to the client. - [Response Transformer Plugin Configuration Reference](https://developer.konghq.com/plugins/response-transformer/reference.md): Modify the upstream response before returning it to the client - [Route By Header Plugin](https://developer.konghq.com/plugins/route-by-header.md): Route requests based on specified request headers - [Route By Header Plugin Changelog](https://developer.konghq.com/plugins/route-by-header/changelog.md): Route requests based on specified request headers - [Route By Header: Route requests based on a location header](https://developer.konghq.com/plugins/route-by-header/examples/route-requests-based-on-a-location-header.md): Configure the plugin to route request to different Upstreams based on the value of the location header. - [Route By Header Plugin Configuration Reference](https://developer.konghq.com/plugins/route-by-header/reference.md): Route requests based on specified request headers - [Route Transformer Advanced Plugin](https://developer.konghq.com/plugins/route-transformer-advanced.md): Transform routing by changing the upstream server, port, or path - [Route Transformer Advanced Plugin Changelog](https://developer.konghq.com/plugins/route-transformer-advanced/changelog.md): Transform routing by changing the upstream server, port, or path - [Route Transformer Advanced: Replace a path with a template](https://developer.konghq.com/plugins/route-transformer-advanced/examples/replace-path-with-template.md): Configure the plugin to replace the path with a custom values that the client can provide using the Custom-Path header. - [Route Transformer Advanced Plugin Configuration Reference](https://developer.konghq.com/plugins/route-transformer-advanced/reference.md): Transform routing by changing the upstream server, port, or path - [Salt Security Plugin](https://developer.konghq.com/plugins/salt-agent.md): Integrate Kong API Gateway with Salt Security Discovery & Prevention for API-based apps - [Salt Security: Enable Salt plugin](https://developer.konghq.com/plugins/salt-agent/examples/enable-salt-plugin.md): Enable the Salt Security plugin by registering the Salt Security backend. - [Salt Security Plugin Configuration Reference](https://developer.konghq.com/plugins/salt-agent/reference.md): Integrate Kong API Gateway with Salt Security Discovery & Prevention for API-based apps - [SAML Plugin](https://developer.konghq.com/plugins/saml.md): Provides SAML v2.0 authentication and authorization between a service provider (Kong) and an identity provider (IdP) - [SAML Plugin Changelog](https://developer.konghq.com/plugins/saml/changelog.md): Provides SAML v2.0 authentication and authorization between a service provider (Kong) and an identity provider (IdP) - [SAML: Set up SAML authentication](https://developer.konghq.com/plugins/saml/examples/saml-authentication.md): Configure the plugin to enable SAML authentication using an anonymous Consumer. - [SAML Plugin Configuration Reference](https://developer.konghq.com/plugins/saml/reference.md): Provides SAML v2.0 authentication and authorization between a service provider (Kong) and an identity provider (IdP) - [Service Protection Plugin](https://developer.konghq.com/plugins/service-protection.md): Prevent abuse and protect services with absolute limits on the number of requests reaching the service - [Service Protection Plugin Changelog](https://developer.konghq.com/plugins/service-protection/changelog.md): Prevent abuse and protect services with absolute limits on the number of requests reaching the service - [Service Protection: Sliding window 5 requests per minute](https://developer.konghq.com/plugins/service-protection/examples/sliding-window-5-req-per-30-min.md): Configure the plugin to set a rate limit of 5 requests per minute. - [Service Protection Plugin Configuration Reference](https://developer.konghq.com/plugins/service-protection/reference.md): Prevent abuse and protect services with absolute limits on the number of requests reaching the service - [Session Plugin](https://developer.konghq.com/plugins/session.md): Support sessions for Kong authentication plugins. - [Session Plugin Changelog](https://developer.konghq.com/plugins/session/changelog.md): Support sessions for Kong authentication plugins. - [Session: Store session data in the cookie](https://developer.konghq.com/plugins/session/examples/cookie-data-storage.md): Stores session data in the cookie itself. - [Session: Specify a secret](https://developer.konghq.com/plugins/session/examples/specify-secret.md): Specifies a secret to use for keyed HMAC generation. - [Session Plugin Configuration Reference](https://developer.konghq.com/plugins/session/reference.md): Support sessions for Kong authentication plugins. - [Skyflow De-identify Plugin](https://developer.konghq.com/plugins/skyflow-ai-data-control.md): Skyflow sanitization plugin for Kong AI Gateway. - [Skyflow De-identify: De-identify and re-identify](https://developer.konghq.com/plugins/skyflow-ai-data-control/examples/deidentify-and-reidentify.md): Enable the Skyflow De-identify plugin with de-identification and re-identification. - [Skyflow De-identify: De-identify only](https://developer.konghq.com/plugins/skyflow-ai-data-control/examples/deidentify-only.md): Enable the Skyflow De-identify plugin in de-identify-only mode. - [Skyflow De-identify Plugin Configuration Reference](https://developer.konghq.com/plugins/skyflow-ai-data-control/reference.md): Skyflow sanitization plugin for Kong AI Gateway. - [Solace Consume Plugin](https://developer.konghq.com/plugins/solace-consume.md): Consume messages from Solace topics and make them available through HTTP endpoints - [Solace Consume Plugin Changelog](https://developer.konghq.com/plugins/solace-consume/changelog.md): Consume messages from Solace topics and make them available through HTTP endpoints - [Solace Consume: Auto mode](https://developer.konghq.com/plugins/solace-consume/examples/auto.md): Configure the Solace Consume plugin to consume messages via automatic format detection. - [Solace Consume: OAuth 2.0 client credentials authentication](https://developer.konghq.com/plugins/solace-consume/examples/oauth-client-credentials.md): Authenticate to a Solace broker using OAuth 2.0 client credentials. Kong Gateway fetches and renews access tokens automatically. - [Solace Consume: Polling mode](https://developer.konghq.com/plugins/solace-consume/examples/polling.md): Configure the Solace Consume plugin in polling mode. - [Solace Consume: Server-sent events mode](https://developer.konghq.com/plugins/solace-consume/examples/server-sent-events.md): Configure the Solace Consume plugin to stream messages using server-sent events. - [Solace Consume: Consume messages over SSL](https://developer.konghq.com/plugins/solace-consume/examples/ssl.md): Configure the Solace Consume plugin to consume messages over SSL. - [Solace Consume: Capture request URI](https://developer.konghq.com/plugins/solace-consume/examples/uri-capture.md): Capture the URI of the request and use it as the message destination name. - [Solace Consume: WebSocket mode](https://developer.konghq.com/plugins/solace-consume/examples/websocket.md): Configure the Solace Consume plugin to stream messages over WebSockets. - [Solace Consume Plugin Configuration Reference](https://developer.konghq.com/plugins/solace-consume/reference.md): Consume messages from Solace topics and make them available through HTTP endpoints - [Solace Log Plugin](https://developer.konghq.com/plugins/solace-log.md): Publish request and response logs to a Solace endpoint or topic - [Solace Log Plugin Changelog](https://developer.konghq.com/plugins/solace-log/changelog.md): Publish request and response logs to a Solace endpoint or topic - [Solace Log: Enable Solace Logging](https://developer.konghq.com/plugins/solace-log/examples/enable-solace-log.md): Set up the Solace logging plugin to send logs to a Solace message broker. - [Solace Log: OAuth 2.0 client credentials authentication](https://developer.konghq.com/plugins/solace-log/examples/oauth-client-credentials.md): Authenticate to a Solace broker using OAuth 2.0 client credentials. Kong Gateway fetches and renews access tokens automatically. - [Solace Log Plugin Configuration Reference](https://developer.konghq.com/plugins/solace-log/reference.md): Publish request and response logs to a Solace endpoint or topic - [Solace Upstream Plugin](https://developer.konghq.com/plugins/solace-upstream.md): Transform requests into Solace messages in a Solace queue or topic - [Solace Upstream Plugin Changelog](https://developer.konghq.com/plugins/solace-upstream/changelog.md): Transform requests into Solace messages in a Solace queue or topic - [Solace Upstream: Send message to Solace queues with persistent delivery](https://developer.konghq.com/plugins/solace-upstream/examples/configure-solace.md): Configure the plugin to connect to a Solace broker using basic authentication, and send messages to multiple queues with persistent delivery. - [Solace Upstream: OAuth 2.0 client credentials authentication](https://developer.konghq.com/plugins/solace-upstream/examples/oauth-client-credentials.md): Authenticate to a Solace broker using OAuth 2.0 client credentials. Kong Gateway fetches and renews access tokens automatically. - [Solace Upstream Plugin Configuration Reference](https://developer.konghq.com/plugins/solace-upstream/reference.md): Transform requests into Solace messages in a Solace queue or topic - [Standard Webhooks Plugin](https://developer.konghq.com/plugins/standard-webhooks.md): Validate that incoming webhooks adhere to the Standard Webhooks specification - [Standard Webhooks Plugin Changelog](https://developer.konghq.com/plugins/standard-webhooks/changelog.md): Validate that incoming webhooks adhere to the Standard Webhooks specification - [Standard Webhooks: Validate webhook](https://developer.konghq.com/plugins/standard-webhooks/examples/validate-webhook.md): Validate an incoming webhook against the Standard Webhooks specification. - [Standard Webhooks Plugin Configuration Reference](https://developer.konghq.com/plugins/standard-webhooks/reference.md): Validate that incoming webhooks adhere to the Standard Webhooks specification - [StatsD Plugin](https://developer.konghq.com/plugins/statsd.md): Send metrics to StatsD - [StatsD Plugin Changelog](https://developer.konghq.com/plugins/statsd/changelog.md): Send metrics to StatsD - [StatsD: Enable StatsD metrics](https://developer.konghq.com/plugins/statsd/examples/log-on-status-range.md): Log requests in a status range to a StatsD server. - [StatsD Plugin Configuration Reference](https://developer.konghq.com/plugins/statsd/reference.md): Send metrics to StatsD - [Straiker Coding Agent Buffered Plugin](https://developer.konghq.com/plugins/straiker-coding-agent-buffered.md): Hold Claude Code and other Anthropic Messages coding agent responses until Straiker Defend scores them, so a denied tool call never reaches the agent - [Straiker Coding Agent Buffered: Enable Straiker Coding Agent Buffered](https://developer.konghq.com/plugins/straiker-coding-agent-buffered/examples/enable-straiker-coding-agent-buffered.md): Enable the Straiker coding agent buffered plugin on an Anthropic Messages route. - [Straiker Coding Agent Buffered Plugin Configuration Reference](https://developer.konghq.com/plugins/straiker-coding-agent-buffered/reference.md): Hold Claude Code and other Anthropic Messages coding agent responses until Straiker Defend scores them, so a denied tool call never reaches the agent - [Straiker Coding Agent Streaming Plugin](https://developer.konghq.com/plugins/straiker-coding-agent-streaming.md): Scan Claude Code and other Anthropic Messages coding agent traffic against Straiker Defend policy without touching the streamed response - [Straiker Coding Agent Streaming: Enable Straiker Coding Agent Streaming](https://developer.konghq.com/plugins/straiker-coding-agent-streaming/examples/enable-straiker-coding-agent-streaming.md): Enable the Straiker Coding Agent Streaming plugin on an Anthropic Messages route. - [Straiker Coding Agent Streaming Plugin Configuration Reference](https://developer.konghq.com/plugins/straiker-coding-agent-streaming/reference.md): Scan Claude Code and other Anthropic Messages coding agent traffic against Straiker Defend policy without touching the streamed response - [Straiker Plugin](https://developer.konghq.com/plugins/straiker.md): Scan chat completion requests and responses against Straiker Defend policy before they reach the client or the upstream model - [Straiker: Enable Straiker](https://developer.konghq.com/plugins/straiker/examples/enable-straiker.md): Enable the Straiker plugin on a chat completion route. - [Straiker Plugin Configuration Reference](https://developer.konghq.com/plugins/straiker/reference.md): Scan chat completion requests and responses against Straiker Defend policy before they reach the client or the upstream model - [Syslog Plugin](https://developer.konghq.com/plugins/syslog.md): Send request and response logs to Syslog - [Syslog Plugin Changelog](https://developer.konghq.com/plugins/syslog/changelog.md): Send request and response logs to Syslog - [Syslog: Enable the Syslog plugin](https://developer.konghq.com/plugins/syslog/examples/enable-syslog.md): Enable the Syslog plugin and set the log level. - [Syslog Plugin Configuration Reference](https://developer.konghq.com/plugins/syslog/reference.md): Send request and response logs to Syslog - [TCP Log Plugin](https://developer.konghq.com/plugins/tcp-log.md): Send request and response logs to a TCP server - [TCP Log Plugin Changelog](https://developer.konghq.com/plugins/tcp-log/changelog.md): Send request and response logs to a TCP server - [TCP Log: Enable TCP Log](https://developer.konghq.com/plugins/tcp-log/examples/enable-tcp-log.md): Enable the TCP Log plugin and send logs to a target server. - [TCP Log Plugin Configuration Reference](https://developer.konghq.com/plugins/tcp-log/reference.md): Send request and response logs to a TCP server - [TLS Handshake Modifier Plugin](https://developer.konghq.com/plugins/tls-handshake-modifier.md): Requests a client to present its client certificate - [TLS Handshake Modifier Plugin Changelog](https://developer.konghq.com/plugins/tls-handshake-modifier/changelog.md): Requests a client to present its client certificate - [TLS Handshake Modifier: Default configuration](https://developer.konghq.com/plugins/tls-handshake-modifier/examples/enable-tcp-handshake-modifier.md): Enable the TLS Handshake Modifier plugin with the default configuration. - [TLS Handshake Modifier Plugin Configuration Reference](https://developer.konghq.com/plugins/tls-handshake-modifier/reference.md): Requests a client to present its client certificate - [TLS Metadata Headers Plugin](https://developer.konghq.com/plugins/tls-metadata-headers.md): Proxies TLS client certificate metadata to upstream services via an HTTP headers - [TLS Metadata Headers Plugin Changelog](https://developer.konghq.com/plugins/tls-metadata-headers/changelog.md): Proxies TLS client certificate metadata to upstream services via an HTTP headers - [TLS Metadata Headers: Inject cert metadata into HTTP headers and define header name](https://developer.konghq.com/plugins/tls-metadata-headers/examples/inject-cert-http-named-header.md): Injects the client certificate in an HTTP header with the name X-Forwarded-Client-Cert. - [TLS Metadata Headers Plugin Configuration Reference](https://developer.konghq.com/plugins/tls-metadata-headers/reference.md): Proxies TLS client certificate metadata to upstream services via an HTTP headers - [TrendAI API Security Plugin](https://developer.konghq.com/plugins/trend-micro-kong-plugin-aps.md): Strengthen your overall API Security with TrendAI Vision One - [TrendAI API Security: Enable the TrendAI API Security plugin](https://developer.konghq.com/plugins/trend-micro-kong-plugin-aps/examples/enable-trendai-plugin.md): Enable the TrendAI API Security plugin to send data to TrendAI Vision One. - [TrendAI API Security Plugin Configuration Reference](https://developer.konghq.com/plugins/trend-micro-kong-plugin-aps/reference.md): Strengthen your overall API Security with TrendAI Vision One - [UDP Log Plugin](https://developer.konghq.com/plugins/udp-log.md): Send request and response logs to a UDP server - [UDP Log Plugin Changelog](https://developer.konghq.com/plugins/udp-log/changelog.md): Send request and response logs to a UDP server - [UDP Log: Enable UDP Log](https://developer.konghq.com/plugins/udp-log/examples/enable-udp-log.md): Enable the UDP Log plugin and send logs to a target server. - [UDP Log Plugin Configuration Reference](https://developer.konghq.com/plugins/udp-log/reference.md): Send request and response logs to a UDP server - [Upstream OAuth Plugin](https://developer.konghq.com/plugins/upstream-oauth.md): Configure Kong Gateway to obtain an OAuth2 token to consume an upstream API - [Upstream OAuth Plugin Changelog](https://developer.konghq.com/plugins/upstream-oauth/changelog.md): Configure Kong Gateway to obtain an OAuth2 token to consume an upstream API - [Upstream OAuth: Use a custom access token header](https://developer.konghq.com/plugins/upstream-oauth/examples/custom-auth-header.md): Configure the Upstream OAuth plugin with a custom header to use when sending the access token (obtained from the IdP) to the upstream service. - [Upstream OAuth Plugin Configuration Reference](https://developer.konghq.com/plugins/upstream-oauth/reference.md): Configure Kong Gateway to obtain an OAuth2 token to consume an upstream API - [Upstream Timeout Plugin](https://developer.konghq.com/plugins/upstream-timeout.md): Set custom timeouts on connections to upstream services to override Gateway Service-level timeouts. - [Upstream Timeout Plugin Changelog](https://developer.konghq.com/plugins/upstream-timeout/changelog.md): Set custom timeouts on connections to upstream services to override Gateway Service-level timeouts. - [Upstream Timeout: Set upstream timeouts](https://developer.konghq.com/plugins/upstream-timeout/examples/set-upstream-timeouts.md): Set a connect, read, and send upstream timeout of 5000 milliseconds. These settings will override any Gateway Service-level timeout settings. - [Upstream Timeout Plugin Configuration Reference](https://developer.konghq.com/plugins/upstream-timeout/reference.md): Set custom timeouts on connections to upstream services to override Gateway Service-level timeouts. - [Vault Authentication Plugin](https://developer.konghq.com/plugins/vault-auth.md): Add Vault authentication to your Services or Routes - [Vault Authentication Plugin OpenAPI Specification](https://developer.konghq.com/plugins/vault-auth/api.md): Add Vault authentication to your Services or Routes - [Vault Authentication Plugin Changelog](https://developer.konghq.com/plugins/vault-auth/changelog.md): Add Vault authentication to your Services or Routes - [Vault Authentication: Enable Vault authentication](https://developer.konghq.com/plugins/vault-auth/examples/enable-vault-authentication.md): Enable the plugin and associate it with a Vault object. - [Vault Authentication Plugin Configuration Reference](https://developer.konghq.com/plugins/vault-auth/reference.md): Add Vault authentication to your Services or Routes - [VeriKnox Plugin](https://developer.konghq.com/plugins/veriknox.md): Cryptographically signed audit receipts for every AI interaction passing through your gateway, with dual classical and post-quantum signatures. - [VeriKnox: LLM inference](https://developer.konghq.com/plugins/veriknox/examples/llm-inference.md): Enable the VeriKnox plugin for LLM inference traffic. - [VeriKnox: MCP tool call](https://developer.konghq.com/plugins/veriknox/examples/mcp-tool-call.md): Enable the VeriKnox plugin for MCP tool-call traffic. - [VeriKnox Plugin Configuration Reference](https://developer.konghq.com/plugins/veriknox/reference.md): Cryptographically signed audit receipts for every AI interaction passing through your gateway, with dual classical and post-quantum signatures. - [WebSocket Size Limit Plugin](https://developer.konghq.com/plugins/websocket-size-limit.md): Block incoming WebSocket messages greater than a specified size - [WebSocket Size Limit Plugin Changelog](https://developer.konghq.com/plugins/websocket-size-limit/changelog.md): Block incoming WebSocket messages greater than a specified size - [WebSocket Size Limit: Limit client and upstream messages](https://developer.konghq.com/plugins/websocket-size-limit/examples/limit-client-and-upstream-messages.md): Limit both client and upstream WebSocket messages. - [WebSocket Size Limit: Limit client messages](https://developer.konghq.com/plugins/websocket-size-limit/examples/limit-client-messages.md): Limit client WebSocket messages to 4 KiB. - [WebSocket Size Limit: Limit upstream messages](https://developer.konghq.com/plugins/websocket-size-limit/examples/limit-upstream-messages.md): Limit upstream WebSocket messages to 1 MiB. - [WebSocket Size Limit Plugin Configuration Reference](https://developer.konghq.com/plugins/websocket-size-limit/reference.md): Block incoming WebSocket messages greater than a specified size - [WebSocket Validator Plugin](https://developer.konghq.com/plugins/websocket-validator.md): Validate WebSocket messages before they are proxied - [WebSocket Validator Plugin Changelog](https://developer.konghq.com/plugins/websocket-validator/changelog.md): Validate WebSocket messages before they are proxied - [WebSocket Validator: Validate client text frames](https://developer.konghq.com/plugins/websocket-validator/examples/validate-client-text-frames.md): This example validates client text frames for WebSocket messages. - [WebSocket Validator Plugin Configuration Reference](https://developer.konghq.com/plugins/websocket-validator/reference.md): Validate WebSocket messages before they are proxied - [XML Threat Protection Plugin](https://developer.konghq.com/plugins/xml-threat-protection.md): Apply structural and size checks on XML payloads - [XML Threat Protection Plugin Changelog](https://developer.konghq.com/plugins/xml-threat-protection/changelog.md): Apply structural and size checks on XML payloads - [XML Threat Protection: Limit XML complexity and attribute sizes](https://developer.konghq.com/plugins/xml-threat-protection/examples/xml-policy.md): Configure an XML Threat Protection policy to catch XML requests that exceed configured limits. - [XML Threat Protection Plugin Configuration Reference](https://developer.konghq.com/plugins/xml-threat-protection/reference.md): Apply structural and size checks on XML payloads - [Zipkin Plugin](https://developer.konghq.com/plugins/zipkin.md): Propagate Zipkin spans and report tracing data to a Zipkin server - [Zipkin Plugin Changelog](https://developer.konghq.com/plugins/zipkin/changelog.md): Propagate Zipkin spans and report tracing data to a Zipkin server - [Zipkin: Extract, clear, and inject](https://developer.konghq.com/plugins/zipkin/examples/extract-clear-inject.md): Configure the Zipkin plugin to extract, clear, and inject tracing context. - [Zipkin: Ignore incoming headers](https://developer.konghq.com/plugins/zipkin/examples/ignore-headers.md): Configure the Zipkin plugin to ignore incoming headers. - [Zipkin: Multiple format injection](https://developer.konghq.com/plugins/zipkin/examples/multiple-injection.md): Configure the Zipkin plugin to inject tracing context in multiple formats. - [Zipkin: Preserve incoming format](https://developer.konghq.com/plugins/zipkin/examples/preserve-format.md): Configure the Zipkin plugin to extract tracing context and inject it in the same type, preserving the format. - [Zipkin Plugin Configuration Reference](https://developer.konghq.com/plugins/zipkin/reference.md): Propagate Zipkin spans and report tracing data to a Zipkin server ## AI Gateway Policies - [ACL Policy](https://developer.konghq.com/ai-gateway/policies/acl.md): Control which AI Consumers and AI Consumer Groups can access entities - [ACL Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/acl/reference.md): Control which AI Consumers and AI Consumer Groups can access entities - [ACME Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/acme/reference.md): Let's Encrypt and ACMEv2 integration with Kong AI Gateway - [AI AWS Guardrails Policy](https://developer.konghq.com/ai-gateway/policies/ai-aws-guardrails.md): Use AWS Guardrails to validate requests and/or responses before forwarding them between clients and upstream LLMs. - [AI AWS Guardrails Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-aws-guardrails/reference.md): Use AWS Guardrails to validate requests and/or responses before forwarding them between clients and upstream LLMs. - [AI Azure Content Safety Policy](https://developer.konghq.com/ai-gateway/policies/ai-azure-content-safety.md): Use Azure AI Content Safety to check and audit messages before proxying them to an upstream LLM - [AI Azure Content Safety Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-azure-content-safety/reference.md): Use Azure AI Content Safety to check and audit messages before proxying them to an upstream LLM - [AI Custom Guardrail Policy](https://developer.konghq.com/ai-gateway/policies/ai-custom-guardrail.md): Use a third-party guardrails service to validate requests and/or responses before forwarding them between clients and upstream LLMs - [AI Custom Guardrail Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-custom-guardrail/reference.md): Use a third-party guardrails service to validate requests and/or responses before forwarding them between clients and upstream LLMs - [AI GCP Model Armor Policy](https://developer.konghq.com/ai-gateway/policies/ai-gcp-model-armor.md): Audit and validate LLM prompts with Google Cloud Model Armor before forwarding them to an upstream LLM. - [AI GCP Model Armor Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-gcp-model-armor/reference.md): Audit and validate LLM prompts with Google Cloud Model Armor before forwarding them to an upstream LLM. - [AI Lakera Guard Policy](https://developer.konghq.com/ai-gateway/policies/ai-lakera-guard.md): Inspect and enforce Lakera Guard safety policies on LLM requests and responses before they reach upstream models. - [AI Lakera Guard Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-lakera-guard/reference.md): Inspect and enforce Lakera Guard safety policies on LLM requests and responses before they reach upstream models. - [AI LLM as Judge Policy](https://developer.konghq.com/ai-gateway/policies/ai-llm-as-judge.md): Score prompt-response pairs with a dedicated LLM to evaluate the accuracy and quality of model responses. - [AI LLM as Judge Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-llm-as-judge/reference.md): Score prompt-response pairs with a dedicated LLM to evaluate the accuracy and quality of model responses. - [AI NVIDIA NeMo Guardrail Policy](https://developer.konghq.com/ai-gateway/policies/ai-nvidia-nemo-guardrail.md): Check LLM requests and responses against NVIDIA NeMo Guardrails and block content that violates your safety rails. - [AI NVIDIA NeMo Guardrail Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-nvidia-nemo-guardrail/reference.md): Check LLM requests and responses against NVIDIA NeMo Guardrails and block content that violates your safety rails. - [AI Prompt Compressor Policy](https://developer.konghq.com/ai-gateway/policies/ai-prompt-compressor.md): Compress prompts before they reach the upstream LLM to stay within context limits, cut token costs, and reduce latency. - [AI Prompt Compressor Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-prompt-compressor/api.md): Compress prompts before they reach the upstream LLM to stay within context limits, cut token costs, and reduce latency. - [AI Prompt Compressor Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-prompt-compressor/reference.md): Compress prompts before they reach the upstream LLM to stay within context limits, cut token costs, and reduce latency. - [AI Prompt Decorator Policy](https://developer.konghq.com/ai-gateway/policies/ai-prompt-decorator.md): Prepend or append an array of messages to a user's chat history. - [AI Prompt Decorator Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-prompt-decorator/reference.md): Prepend or append an array of messages to a user's chat history. - [AI Prompt Guard Policy](https://developer.konghq.com/ai-gateway/policies/ai-prompt-guard.md): Check text completion requests against a list of allowed or denied expressions - [AI Prompt Guard Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-prompt-guard/reference.md): Check text completion requests against a list of allowed or denied expressions - [AI Prompt Template Policy](https://developer.konghq.com/ai-gateway/policies/ai-prompt-template.md): Provide fill-in-the-blank AI prompts to users - [AI Prompt Template Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-prompt-template/reference.md): Provide fill-in-the-blank AI prompts to users - [AI RAG Injector Policy](https://developer.konghq.com/ai-gateway/policies/ai-rag-injector.md): Create RAG pipelines by automatically injecting content from a vector database - [AI RAG Injector Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-rag-injector/reference.md): Create RAG pipelines by automatically injecting content from a vector database - [AI Rate Limiting Advanced Policy](https://developer.konghq.com/ai-gateway/policies/ai-rate-limiting-advanced.md): Provides rate limiting for the AI plugins. - [AI Rate Limiting Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-rate-limiting-advanced/reference.md): Provides rate limiting for the AI plugins. - [AI Request Transformer Policy](https://developer.konghq.com/ai-gateway/policies/ai-request-transformer.md): Use an LLM service to transform a client request body prior to proxying the request to the upstream server - [AI Request Transformer Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-request-transformer/reference.md): Use an LLM service to transform a client request body prior to proxying the request to the upstream server - [AI Response Transformer Policy](https://developer.konghq.com/ai-gateway/policies/ai-response-transformer.md): Use an LLM service to transform the upstream HTTP(S) prior to forwarding it to the client - [AI Response Transformer Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-response-transformer/reference.md): Use an LLM service to transform the upstream HTTP(S) prior to forwarding it to the client - [AI PII Sanitizer Policy](https://developer.konghq.com/ai-gateway/policies/ai-sanitizer.md): Protect sensitive information in client request or response bodies before they reach upstream services or clients - [AI PII Sanitizer Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-sanitizer/api.md): Protect sensitive information in client request or response bodies before they reach upstream services or clients - [AI PII Sanitizer Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-sanitizer/reference.md): Protect sensitive information in client request or response bodies before they reach upstream services or clients - [AI Semantic Cache Policy](https://developer.konghq.com/ai-gateway/policies/ai-semantic-cache.md): Cache LLM responses based on semantic similarity between requests to reduce latency and cost. - [AI Semantic Cache Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-semantic-cache/reference.md): Cache LLM responses based on semantic similarity between requests to reduce latency and cost. - [AI Semantic Prompt Guard Policy](https://developer.konghq.com/ai-gateway/policies/ai-semantic-prompt-guard.md): Permit or block LLM prompts based on semantic similarity to predefined allow and deny rules. - [AI Semantic Prompt Guard Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-semantic-prompt-guard/reference.md): Permit or block LLM prompts based on semantic similarity to predefined allow and deny rules. - [AI Semantic Response Guard Policy](https://developer.konghq.com/ai-gateway/policies/ai-semantic-response-guard.md): Permit or block LLM responses based on semantic similarity to predefined rules for chat, completions, and embeddings requests - [AI Semantic Response Guard Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ai-semantic-response-guard/reference.md): Permit or block LLM responses based on semantic similarity to predefined rules for chat, completions, and embeddings requests - [AppDynamics Policy](https://developer.konghq.com/ai-gateway/policies/app-dynamics.md): Integrate AI Gateway with the AppDynamics APM Platform - [AppDynamics Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/app-dynamics/reference.md): Integrate AI Gateway with the AppDynamics APM Platform - [AWS Lambda Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/aws-lambda/reference.md): Invoke and manage AWS Lambda functions from Kong AI Gateway - [Azure Functions Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/azure-functions/reference.md): Invoke and manage Azure functions from Kong AI Gateway - [Bot Detection Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/bot-detection/reference.md): Detect and block bots or custom clients - [Canary Release Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/canary/reference.md): Slowly roll out software changes to a subset of users - [Confluent Consume Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/confluent-consume/reference.md): Consume messages from Confluent Cloud Kafka topics and make them available through HTTP endpoints - [Confluent Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/confluent/reference.md): Transform requests into Kafka messages in a Confluent Kafka topic. - [Correlation ID Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/correlation-id/reference.md): Correlate requests and responses using a unique ID - [CORS Policy](https://developer.konghq.com/ai-gateway/policies/cors.md): Configure Cross-Origin Resource Sharing (CORS) so that browser clients on approved origins can call your AI Models, AI Agents, and AI MCP Servers. - [CORS Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/cors/reference.md): Configure Cross-Origin Resource Sharing (CORS) so that browser clients on approved origins can call your AI Models, AI Agents, and AI MCP Servers. - [Datadog Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/datadog/reference.md): Visualize metrics on Datadog - [Datakit Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/datakit/reference.md): Datakit is a workflow engine for working with external APIs - [DeGraphQL Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/degraphql/reference.md): Transform a GraphQL upstream into a REST API - [Exit Transformer Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/exit-transformer/reference.md): Customize Kong exit responses sent downstream - [File Log Policy](https://developer.konghq.com/ai-gateway/policies/file-log.md): Append request and response data to a log file - [File Log Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/file-log/reference.md): Append request and response data to a log file - [Forward Proxy Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/forward-proxy/reference.md): Allows Kong AI Gateway to connect to intermediary transparent HTTP - [GraphQL Proxy Caching Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/graphql-proxy-cache-advanced/reference.md): Cache and serve commonly requested responses in Kong AI Gateway - [GraphQL Rate Limiting Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/graphql-rate-limiting-advanced/reference.md): Provides rate limiting for GraphQL queries - [gRPC-Gateway Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/grpc-gateway/reference.md): Access gRPC services through HTTP REST - [gRPC-Web Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/grpc-web/reference.md): Allow browser clients to call gRPC services - [HTTP Log Policy](https://developer.konghq.com/ai-gateway/policies/http-log.md): Send request and response logs to an HTTP server - [HTTP Log Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/http-log/reference.md): Send request and response logs to an HTTP server - [Injection Protection Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/injection-protection/reference.md): Detect and block injection attacks using regular expressions - [IP Restriction Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/ip-restriction/reference.md): Allow or deny IPs that can make requests to your services - [jq Policy](https://developer.konghq.com/ai-gateway/policies/jq.md): Transform JSON objects included in API requests or responses using jq programs - [jq Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/jq/reference.md): Transform JSON objects included in API requests or responses using jq programs - [JSON Threat Protection Policy](https://developer.konghq.com/ai-gateway/policies/json-threat-protection.md): Apply size checks on JSON payload and minimize risk of content-level attacks - [JSON Threat Protection Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/json-threat-protection/reference.md): Apply size checks on JSON payload and minimize risk of content-level attacks - [JWE Decrypt Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/jwe-decrypt/reference.md): Decrypt a JWE token in a request - [Kafka Consume Policy](https://developer.konghq.com/ai-gateway/policies/kafka-consume.md): Consume messages from Kafka topics and make them available through HTTP endpoints. - [Kafka Consume Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/kafka-consume/reference.md): Consume messages from Kafka topics and make them available through HTTP endpoints. - [Kafka Log Policy](https://developer.konghq.com/ai-gateway/policies/kafka-log.md): Publish logs to a Kafka topic. - [Kafka Log Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/kafka-log/reference.md): Publish logs to a Kafka topic. - [Kafka Upstream Policy](https://developer.konghq.com/ai-gateway/policies/kafka-upstream.md): Transform requests into Kafka messages in a Kafka topic. - [Kafka Upstream Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/kafka-upstream/reference.md): Transform requests into Kafka messages in a Kafka topic. - [Loggly Policy](https://developer.konghq.com/ai-gateway/policies/loggly.md): Send request and response logs to Loggly - [Loggly Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/loggly/reference.md): Send request and response logs to Loggly - [Metering & Billing Policy](https://developer.konghq.com/ai-gateway/policies/metering-and-billing.md): A licensed add-on through Konnect Metering & Billing. Meter API requests and AI token usage for usage-based billing. Supports flexible customer identification, custom pricing dimensions, and fine-grained traffic filtering. - [Metering & Billing Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/metering-and-billing/reference.md): A licensed add-on through Konnect Metering & Billing. Meter API requests and AI token usage for usage-based billing. Supports flexible customer identification, custom pricing dimensions, and fine-grained traffic filtering. - [Mocking Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/mocking/reference.md): Provide mock endpoints to test your APIs against your Services - [OAS Validation Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/oas-validation/reference.md): Validate HTTP requests and responses based on an OpenAPI 3.0 or Swagger API Specification - [OPA Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/opa/reference.md): Authorize requests against Open Policy Agent - [OpenTelemetry Policy](https://developer.konghq.com/ai-gateway/policies/opentelemetry.md): Propagate spans and report space to a backend server through OTLP protocol. - [OpenTelemetry Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/opentelemetry/reference.md): Propagate spans and report space to a backend server through OTLP protocol. - [Post-Function Policy](https://developer.konghq.com/ai-gateway/policies/post-function.md): Add and manage custom Lua functions to execute after other plugins - [Post-Function Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/post-function/reference.md): Add and manage custom Lua functions to execute after other plugins - [Pre-Function Policy](https://developer.konghq.com/ai-gateway/policies/pre-function.md): Add and manage custom Lua functions to run before other plugins - [Pre-Function Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/pre-function/reference.md): Add and manage custom Lua functions to run before other plugins - [Prometheus Policy](https://developer.konghq.com/ai-gateway/policies/prometheus.md): Expose metrics related to Kong AI Gateway in Prometheus exposition format - [Prometheus Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/prometheus/reference.md): Expose metrics related to Kong AI Gateway in Prometheus exposition format - [Proxy Caching Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/proxy-cache-advanced/reference.md): Cache and serve commonly requested responses in Kong, in-memory or using Redis - [Proxy Cache Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/proxy-cache/reference.md): Cache and serve commonly requested responses in Kong - [Rate Limiting Advanced Policy](https://developer.konghq.com/ai-gateway/policies/rate-limiting-advanced.md): Enhanced rate limiting capabilities such as sliding window support, Redis Sentinel support, and increased performance. - [Rate Limiting Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/rate-limiting-advanced/reference.md): Enhanced rate limiting capabilities such as sliding window support, Redis Sentinel support, and increased performance. - [Rate Limiting Policy](https://developer.konghq.com/ai-gateway/policies/rate-limiting.md): Limit how many HTTP requests can be made in a given period of seconds, minutes, hours, days, months, or years. - [Rate Limiting Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/rate-limiting/reference.md): Limit how many HTTP requests can be made in a given period of seconds, minutes, hours, days, months, or years. - [Redirect Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/redirect/reference.md): Redirect incoming requests to a new URL - [Request Callout Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/request-callout/reference.md): Insert arbitrary API calls before proxying a request to the upstream service. - [Request Size Limiting Policy](https://developer.konghq.com/ai-gateway/policies/request-size-limiting.md): Block requests with bodies greater than a specified size. - [Request Size Limiting Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/request-size-limiting/reference.md): Block requests with bodies greater than a specified size. - [Request Termination Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/request-termination/reference.md): Terminates all requests with a specific response - [Request Transformer Advanced Policy](https://developer.konghq.com/ai-gateway/policies/request-transformer-advanced.md): Use powerful regular expressions, variables, and templates to transform API requests - [Request Transformer Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/request-transformer-advanced/reference.md): Use powerful regular expressions, variables, and templates to transform API requests - [Request Transformer Policy](https://developer.konghq.com/ai-gateway/policies/request-transformer.md): Use regular expressions, variables, and templates to transform requests - [Request Transformer Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/request-transformer/reference.md): Use regular expressions, variables, and templates to transform requests - [Request Validator Policy](https://developer.konghq.com/ai-gateway/policies/request-validator.md): Validates requests before they reach the upstream service - [Request Validator Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/request-validator/reference.md): Validates requests before they reach the upstream service - [Response Rate Limiting Policy](https://developer.konghq.com/ai-gateway/policies/response-ratelimiting.md): Rate limit based on a custom response header value. - [Response Rate Limiting Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/response-ratelimiting/reference.md): Rate limit based on a custom response header value. - [Response Transformer Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/response-transformer-advanced/reference.md): Modify the upstream response before returning it to the client, with greater customization capabilities - [Response Transformer Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/response-transformer/reference.md): Modify the upstream response before returning it to the client - [Route By Header Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/route-by-header/reference.md): Route requests based on specified request headers - [Route Transformer Advanced Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/route-transformer-advanced/reference.md): Transform routing by changing the upstream server, port, or path - [Service Protection Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/service-protection/reference.md): Prevent abuse and protect services with absolute limits on the number of requests reaching the service - [Solace Consume Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/solace-consume/reference.md): Consume messages from Solace topics and make them available through HTTP endpoints - [Solace Log Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/solace-log/reference.md): Publish request and response logs to a Solace endpoint or topic - [Solace Upstream Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/solace-upstream/reference.md): Transform requests into Solace messages in a Solace queue or topic - [Standard Webhooks Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/standard-webhooks/reference.md): Validate that incoming webhooks adhere to the Standard Webhooks specification - [StatsD Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/statsd/reference.md): Send metrics to StatsD - [Syslog Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/syslog/reference.md): Send request and response logs to Syslog - [TCP Log Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/tcp-log/reference.md): Send request and response logs to a TCP server - [TLS Handshake Modifier Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/tls-handshake-modifier/reference.md): Requests a client to present its client certificate - [TLS Metadata Headers Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/tls-metadata-headers/reference.md): Proxies TLS client certificate metadata to upstream services via an HTTP headers - [UDP Log Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/udp-log/reference.md): Send request and response logs to a UDP server - [Upstream Timeout Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/upstream-timeout/reference.md): Set custom timeouts on connections to upstream services to override Gateway Service-level timeouts. - [WebSocket Size Limit Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/websocket-size-limit/reference.md): Block incoming WebSocket messages greater than a specified size - [WebSocket Validator Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/websocket-validator/reference.md): Validate WebSocket messages before they are proxied - [XML Threat Protection Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/xml-threat-protection/reference.md): Apply structural and size checks on XML payloads - [Zipkin Policy Configuration Reference](https://developer.konghq.com/ai-gateway/policies/zipkin/reference.md): Propagate Zipkin spans and report tracing data to a Zipkin server