Access Point

Field reference for the Access Point panel settings and canvas elements: the inbound configuration of an Agent Surface.

The Access Point is the inbound listener node on an Agent Surface. It defines the URL callers use to reach the managed agent and controls routing at the surface entry point.

Every surface has exactly one Access Point. The Listen Address, Surface Prefix, and Custom Path panel fields together form the base URL callers use to reach the surface. The protocol is set at the surface level; see Protocol options.

Panel settings

FieldTypeRequiredDefaultDescription
NamestringNo“Access Point”Friendly display name shown in the dashboard (for example in monitoring slice pickers). Has no effect on routing.
Listen AddressdropdownYes—Gateway listener this Access Point binds to. Populated from the gateway’s configured inbound addresses.
Surface PrefixdropdownYes—Route namespace prefix. Populated from the gateway’s configured surface prefixes. Combined with Custom Path to form the full route.
Custom PathstringYesAuto-generatedPath segment appended to the Surface Prefix. Must not contain .. segments.
Channel RoutestringRead-onlyDerivedAssembled route displayed as the Access Point URL. Read-only banner.

A2A surfaces only

FieldTypeRequiredDefaultDescription
Primary extension URIstringNoNonePrimary A2A extension URI used for dashboard display and metrics grouping.
Supported extensionsstring, comma-separatedNo[]A2A extension URIs advertised in the agent card.
Override Agent Card LocationtoggleNoOffWhen on, overrides the default agent card path.
Agent Card LocationstringNo.well-known/agent-card.jsonCustom agent card path relative to the managed agent base URL. Shown only when Override Agent Card Location is on.

Canvas elements

These canvas elements add capabilities at the inbound pipeline stage, before a request reaches the managed agent. Each one attaches to a specific edge, either the Caller → Access Point edge (before the request reaches the Access Point) or the Access Point → Managed Agent edge itself. The Behaviour column below states each element’s actual edge; see the linked reference page for the full placement detail.

ElementReferenceBehaviour at this position
PolicyOPA policies: Policy elementAttaches to the Caller → Access Point edge as the inbound policy variant. Evaluated before the request reaches the Managed Agent.
Rate LimitNetworking elements: Rate LimitAttaches to the Caller → Access Point edge. Inbound request cap applied at the surface entry point.
Caller ContextCaller Context referenceAttaches to the Caller → Access Point edge. Authentication method selection and per-method credential extraction configuration.
IdentityIdentity element referenceAttaches to the Caller → Access Point edge for inbound caller identity, or to the Access Point → Caller response edge for protected agent identity (the managed agent’s own DID, extracted from its reply). See the linked reference for the full slot list.
Trust CheckTrust elements referenceAttaches to the Access Point → Managed Agent edge as the caller leg. Per-element TRQP verification on the caller leg. Results appear as input.trust_check_results.caller in OPA evaluation.
Extension ValidationProtocol extensions referenceAttaches to the Access Point → Managed Agent request edge. Schema validation applied to inbound request payloads. A2A surfaces only.
Metadata ExtractionMetadata elements referenceAttaches to the Access Point → Managed Agent request edge on A2A surfaces. Header-to-metadata mapping at the access point boundary. Disabled on MCP surfaces, where the header mapping editor does not appear.