Create your first surface

Create your first Agent Surface in the Agent Gateway dashboard and send a test request in under five minutes.

By the end of this guide, you will have an Agent Surface that accepts requests from an AI agent and forwards them to a backend service of your choice.

Prerequisites

  • You are logged in to the dashboard.
  • A backend service with a publicly accessible URL for the gateway to forward requests to.
  • No backend yet? Use the Echo server as a test target. Start it locally and expose it publicly using a tunnel tool of your choice.

Steps

Start a new surface

Navigate to Surfaces in the sidebar.

Select Add Surface.

Surfaces page with the add surface action

The Start a new surface dialog shows a list of starter templates. Each entry shows the template name, a short description, and its protocol badge. Select an A2A starter template for this guide.

The surface builder opens with the canvas already populated from the template.

Surface builder canvas after applying an A2A starter template

The surface is given a default name made from its protocol and a number, such as a2a_surface_1. To update it, select the blue Surface container on the canvas. The Name field is in the settings panel that opens on the right.

Configure the Access Point

The Access Point element defines how incoming traffic reaches the surface. Select it in the canvas to open its settings panel.

Surface - configure Access Point

Under Routing, set the following fields:

FieldValue for this guideNotes
Surface Prefix(auto-seeded)Pre-filled from your gateway instance configuration. Accept the default.
Custom Pathfirst-surfaceIdentifies this surface in the full route. The auto-seeded value is a random two-word path. Update it to something meaningful.

The Entry point URL banner at the top of the panel shows the full URL other agents use to reach this surface: the listen address, surface prefix, and custom path combined. The same URL also appears in a banner at the top of the canvas. Select the copy icon next to the URL and keep it for Step 5.

Configure the Managed Agent

The Managed Agent element forwards requests to your backend service. Select it in the canvas to open its settings panel.

Surface - configure Managed agent

Set Target Endpoint URL to your backend service’s publicly accessible URL.

If required fields are missing:

  • Visual alerts appear.
  • Elements are highlighted.
  • The Elements tab in the sidebar shows incomplete configuration.

Save the surface

Select the green ✓ button in the sidebar to save the surface.

  • The surface is saved immediately.
  • No restart is required.

A success notification confirms the surface was created, and you are returned to the Surfaces list where the new surface appears.

Send a test request

Replace <ENTRY_POINT_URL> in the command below with the Entry point URL you copied in Step 2.

curl -k -X POST "<ENTRY_POINT_URL>" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "message/send",
    "id": "test-001",
    "params": {
      "message": {
        "role": "user",
        "messageId": "msg-001",
        "parts": [{ "kind": "text", "text": "Hello from the quickstart" }]
      }
    }
  }'

If using the echo server, a successful response returns 200 OK with a JSON body containing the echoed method, path, headers, and body. The full request is also printed to the echo server’s terminal. For your own backend, a successful response depends on your service.

Confirm

Select the Monitoring tab in the surface detail page. You should see a request entry recorded for the test you sent in Step 5.

Troubleshooting

SymptomLikely causeFix
400 Bad Request on createA required field is missing.Ensure Surface Prefix and Custom Path are set on the Access Point element (Step 2), and that Target Endpoint URL is set on the Managed Agent element (Step 3).
404 Not FoundThe URL in the curl command does not match the Entry point URL.Copy the exact URL from the Entry point URL banner on the canvas or the Access Point element and retry.
Connection refusedThe gateway hostname or port in your command is incorrect.Confirm the URL uses the listen address shown in the Entry point URL banner. Contact your administrator if the connection is still refused.
502 Bad GatewayThe target endpoint is unreachable from the gateway host.Confirm your backend is reachable from the gateway. For a hosted gateway, localhost is not accessible. Expose your backend through a tunnel and update the Target Endpoint URL on the Managed Agent element (see Echo server for an example).
401 UnauthorizedUnlikely to come from the surface itself: a Caller Context element passes a missing or invalid credential to policy rather than rejecting it on its own. Check whether your target backend requires its own authentication.Confirm the target endpoint’s authentication requirements, or continue to Add identity and access control to add caller authentication with an explicit policy.

Next steps