Access Point

Field reference for the AccessPoint section: the inbound configuration of an Agent Surface.

The Access Point configuration defines the front door of an Agent Surface: how callers discover, authenticate with, and reach the managed agent through the gateway.

Every surface has exactly one Access Point. The Listener address and Channel Route fields together form the base URL callers use to reach the surface. The Protocol field governs both inbound and target communication; the gateway does not translate between protocols.

Fields

FieldTypeRequiredDefaultDescription
NamestringNoNoneFriendly display name shown in the dashboard (for example in monitoring slice pickers). Never used for routing.
Listener addressstringYes—Network address to bind, for example 0.0.0.0:8443. Must map to a configured listener. Selected from available addresses in the Channel Route section.
Channel RoutestringYes—Path prefix that distinguishes this surface from others on the same port. Forms the base URL: https://{host}:{port}{route}. Auto-prefixed with / on save if missing.
ProtocolProtocol optionsYesA2A / UCPAgent protocol used for both inbound and target communication. Set on the Surface root node.
Caller AuthCaller authenticationNoNoneHow to verify the caller’s identity at the transport level. When absent, no transport-level authentication is enforced.
Agent IdentityAgent IdentityNoNoneHow to derive the managed agent DID from the request.
Policy DefinitionPolicy definitionNoNoneAccess-point-level OPA policy. Evaluated before the target pipeline.
Rate LimitRate limitNoNoneInbound rate limiting applied at the access point.
Extension ValidationExtensionRulesNoNoneSchema validation applied to inbound request payloads.
Trust RegistryTrustRegistryVerificationConfigNoDisabledCaller verification against a trust registry.
Trust CheckTrust Check elementsNo[]Per-element TRQP verification on the caller leg (Access Point → Managed Agent). Results appear as input.trust_check_results.caller in OPA evaluation.
Publish to Gateway DID documentboolNofalseWhether to advertise this surface in the gateway’s DID document. Set on the Surface root node.
Supported extensionsstring[]No[]A2A extension URIs advertised in the agent card.
Primary extension URIstringNoNonePrimary A2A extension URI used for dashboard display and metrics grouping.
Agent Card LocationstringNoNoneOverride for the agent card path relative to the base URL. Enabled via the Override Agent Card Location checkbox. Defaults to /.well-known/agent.json.
Custom MetadataCustomMetadataNoNoneCustom metadata injected into responses at the access-point level.

Caller authentication

Configure one or more authentication methods using the Authentication Method dropdown in the Access Point panel. The gateway evaluates each in order and accepts the first success.

Available authentication methods: jwt_bearer (JWT Bearer), api_key (API Key (secret store)), api_key_provider (API Key (provider)), did_auth (DID Auth), mtls (mTLS (Mutual TLS)).

Agent Identity

Configures how the gateway derives the managed agent DID from the inbound request. Select a strategy using the Identity canvas element on the Access Point edge.

StrategyDescription
From PayloadExtracts dot-notation field paths from the request body and hashes them into a DID.
From mTLS certificateDerives the DID from the client certificate CN or SAN.
From API KeyMaps the validated API key to a pre-registered agent DID.
From JWT ClaimsExtracts the DID from a named JWT claim. Requires JWT Bearer caller authentication.
Static DIDUses a fixed DID for all requests through this surface.
NoneNo managed agent DID is resolved.