Access Point
Field reference for the Access Point panel settings and canvas elements: the inbound configuration of an Agent Surface.
The Access Point is the inbound listener node on an Agent Surface. It defines the URL callers use to reach the managed agent and controls routing at the surface entry point.
Every surface has exactly one Access Point. The Listen Address, Channel Prefix, and Custom Path panel fields together form the base URL callers use to reach the surface. The protocol is set at the surface level; see Protocol options.
Panel settings
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Name | string | No | “Access Point” | Friendly display name shown in the dashboard (for example in monitoring slice pickers). Has no effect on routing. |
| Listen Address | dropdown | Yes | — | Gateway listener this Access Point binds to. Populated from the gateway’s configured inbound addresses. |
| Channel Prefix | dropdown | Yes | — | Route namespace prefix. Populated from the gateway’s configured channel prefixes. Combined with Custom Path to form the full route. |
| Custom Path | string | Yes | Auto-generated | Path segment appended to the Channel Prefix. Must not contain .. segments. |
| Channel Route | string | Read-only | Derived | Assembled route displayed as the Access Point URL. Read-only banner. |
A2A and AP2 surfaces only
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Primary extension URI | string | No | None | Primary A2A extension URI used for dashboard display and metrics grouping. |
| Supported extensions | string, comma-separated | No | [] | A2A extension URIs advertised in the agent card. |
| Override Agent Card Location | toggle | No | Off | When on, overrides the default agent card path. |
| Agent Card Location | string | No | .well-known/agent-card.json | Custom agent card path relative to the managed agent base URL. Shown only when Override Agent Card Location is on. |
Canvas elements
Drop elements on the Access Point → Managed Agent edge to add capabilities at the inbound pipeline stage, before the request reaches the managed agent.
| Element | Reference | Behaviour at this position |
|---|---|---|
| Policy | OPA policies: Policy element | OPA policy evaluated on inbound requests before the target pipeline. |
| Rate Limit | Networking elements: Rate Limit | Inbound request cap applied at the surface entry point. |
| Caller Context | Caller Context reference | Authentication method selection and per-method credential extraction configuration. |
| Identity | Identity element reference | How to derive the managed agent DID from the inbound request. |
| Trust Check | Trust elements reference | Per-element TRQP verification on the caller leg. Results appear as input.trust_check_results.caller in OPA evaluation. |
| Extension Validation | Protocol extensions reference | Schema validation applied to inbound request payloads. A2A and AP2 surfaces only. |
| Metadata | Metadata elements reference | Header-to-metadata mapping at the access point boundary. |
Related
- Surface reference: Top-level surface fields, protocol options, and gateway DID injection settings.
- Managed Agent reference: Upstream endpoint and authentication fields.
- Caller Context reference: Authentication method options and per-method credential extraction configuration.
- Trust elements reference: Full field reference for Trust Check elements, query parameters, template syntax, and result wire shape.
Was this page helpful?
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.