Transit Points
Field reference for Transit Points: shared settings and per-destination configuration for agent-initiated outbound routes on an Agent Surface.
Transit Points define the agent-initiated outbound routes on a surface: the destinations the managed agent is allowed to call through the gateway. The managed agent calls the transit listener; the gateway forwards the call to the configured external endpoint.
Shared settings
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Outbound Listener Address | string | No | None | Separate listen address for the outbound listener. When absent, transit shares the access point’s listen address. |
Named outbound destinations are added, reordered, and removed via the canvas. The following shared settings apply to all transit points on the surface.
Shared transit fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Transit Token Mode | Transit token mode | No | Embedded | How caller context is carried in transit tokens. |
| Transit Policy ID | Policy definition | No | None | Global OPA policy evaluated on all outbound calls before dispatch. |
| Outbound Rate Limit | Rate limit | No | None | Total outbound rate limit applied across all transit points. |
| Sign every outbound request | bool | No | true | Inject a signed VP into every outbound request. |
| Workload Binding | WorkloadBindingConfig | No | None | Controls which fields appear in signed VPs. |
| Extension Validation | ExtensionRules | No | None | Schema validation applied to outbound request bodies. |
| Custom Metadata | CustomMetadata | No | None | Custom metadata injected into outbound requests. |
| Extension Validation (response) | ExtensionRules | No | None | Schema validation applied to transit response bodies. |
| Trust Registry | TrustRegistryVerificationConfig | No | None | Verifies transit targets against a trust registry. |
| Authentication Method | SourceAuthConfig | No | None | Source authentication for the transit listener (authenticates the protected agent calling out). |
Transit token mode options
| Mode | Behaviour |
|---|---|
| Embedded | Caller context is encrypted into the token itself. Stateless but produces larger tokens. Default. |
| Reference | Caller context is stored server-side; the token is a short reference key. Smaller tokens but requires server state. |
Transit Point configuration
A single named outbound destination. Each transit point is reachable at:
https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>/<optional-path>Or at a custom path when listen_path is set on the transit point.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Transit Point ID | string (UUID) | No | Auto-generated | Stable internal identifier. Used by the task monitor and metrics store. Never appears in URLs. |
| Name | string | No | "" | Friendly display name. Drives the auto-derived alias shown as “Routing alias derived from the name above”. |
| Routing alias | string | Yes | — | URL-safe routing identifier (derived from name). Must match ^[a-z][a-z0-9-]*$ (lowercase, digits, dashes; must start with a letter). Forms the path segment in the outbound URL. Must be unique within the surface. |
| Target Endpoint | string | Yes | — | The external destination endpoint. Accepts https:// URLs. Shown under the Destination section. |
| Destination protocol | string | No | A2A / UCP | Protocol spoken by the destination. Can differ from the access point protocol. Options: A2A / UCP, AP2, MCP, MPX, DIDComm. |
| Authentication | TargetAuthConfig | No | None | Credentials injected into outbound requests to this destination. |
| Policy Definition | Policy definition | No | None | Per-destination OPA policy evaluated before dispatch. |
| Policy Definition (response) | Policy definition | No | None | Per-destination OPA policy evaluated on the response before forwarding back. Independent of the target response_policy. |
| Payment | TransitPaymentPolicy | No | None | Payment requirements if the destination charges. |
| Networking | Networking | No | None | Timeout, retry, and circuit breaker configuration for this destination. |
| Rate Limit | Rate limit | No | None | Per-destination rate limit. Applied before dispatch to this endpoint. The transit-shared and surface-wide limits still apply independently. |
| Agent Identity | Identity injection | No | {} | VP signing and identity extraction for outbound requests to this destination. |
| Transit Point identity | ManagedIdentityConfig | No | None | Identity extraction from this transit point’s response. When set, overrides the surface-level external identity slot for this transit point only. |
| Transit Credentials | TransitCredentials | No | None | OAuth or API token management for this destination. |
| Agent Card Location | string | No | None | Override for the agent card path at the destination. Independent of the access point’s agent_card_path. Defaults to /.well-known/agent-card.json when absent. |
URL patterns
The outbound URL shape depends on whether a custom listener path is set on the transit point.
Default path
https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>/<optional-path>Custom listener path
https://<GATEWAY_HOST>/<custom-path>/<optional-path>The /outgoing/... pattern is the standard. Use a custom listener path only when an external system requires a specific path that cannot use the default shape.
Related
- Target reference: The primary inbound target.
- Variants reference: Per-variant transit overrides.
- MCP surface starter: Step-by-step guide for configuring a transit point.
Was this page helpful?
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.