Transit Points
Transit Points define the agent-initiated outbound routes on a surface: the destinations the managed agent is allowed to call through the gateway. The managed agent calls the transit listener. The gateway forwards the call to the configured external endpoint. Use this reference when adding outbound destinations to a surface to understand routing alias requirements and per-destination policy, rate limit, and payment settings.
Transit Point configuration
A single named outbound destination. Configure routing and authentication using the panel settings below. Drop canvas elements on the transit point edge to add capabilities per destination. The same elements available on Access Point and Managed Agent edges apply here, scoped to this destination only.
Each transit point is reachable at:
https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>/<optional-path>Or at a custom path when listen_path is set on the transit point.
Panel settings
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Name | string | No | “Transit Point” | Display name shown on the canvas node and in the dashboard. Determines the Routing alias. |
| Listen Address | dropdown | Yes | — | Outbound listener host and port for this transit point. Selected from configured outbound listeners. |
| Channel Prefix | dropdown | Yes | — | Path prefix for the listener URL. Selected from configured channel prefixes. |
| Custom Path | string | Yes | Auto-generated | Path suffix appended after the channel prefix. Auto-generated as a random path on first drop; editable. |
| Listener URL | string | Read-only | Derived | Assembled outbound listener URL. Read-only banner. |
| Routing alias | string | Read-only | Derived | Derived from the Name field. Forms the path segment in the standard outbound URL: https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>. Must match ^[a-z][a-z0-9-]*$. |
| Target Endpoint | string | Yes | — | External destination URL (https://). Use the via Gateway Connection option to route to another Trust Gateway instead. |
| Override Agent Card Location | toggle | No | Off | When on, overrides the default agent card path for this destination. A2A and AP2 destinations only. |
| Agent Card Location | string | No | .well-known/agent-card.json | Custom agent card path relative to the destination base URL. Shown only when Override Agent Card Location is on. |
| Target Authentication | select | No | None | Service-level credentials injected into outbound requests. Options: None, Bearer Token, API Key Header, Custom Header. |
| Inject outbound credential | toggle | No | Off | When on, pulls a credential from a configured provider and attaches it to every outbound request through this transit point. Expands to show Credential Provider, Scopes, Consent Mode, and Inject As fields. |
| Require transit token | toggle | No | On | When on, every call to this transit point must carry a valid X-Transit-Token header issued by the surface’s Access Point. |
Canvas elements
Drop these elements on the transit point edge in the canvas builder. For the complete field reference for each element, see the linked page.
| Element | Reference | Behaviour at this position |
|---|---|---|
| Policy | OPA policies: Policy element | OPA policy evaluated on requests to this destination before dispatch. |
| Policy (response) | OPA policies: Policy element | OPA policy evaluated on the response from this destination before forwarding back. |
| Rate Limit | Networking elements: Rate Limit | Per-destination request cap. |
| Trust Registry | Trust registries | Verifies this transit destination against a trust registry before forwarding. |
| Agent Identity | Identity element | VP signing and identity extraction for outbound requests to this destination. |
| Transit Point identity | Identity element | Identity extraction from this destination’s response. When set, overrides the surface-level external identity slot for this transit point only. |
| Workload Binding | Outbound binding elements: Workload Binding | Caller workload identity claims in signed VPs for this destination. |
| Networking | Networking elements | Timeout, retry, and circuit breaker for this destination. |
| Payment | Payment element | Payment requirements if this destination charges. |
| Metadata Extraction | Metadata elements | Outbound header mapping from the response. A2A and AP2 destinations only. |
URL patterns
The outbound URL shape depends on whether a custom listener path is set on the transit point.
Default path
https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>/<optional-path>Custom listener path
https://<GATEWAY_HOST>/<custom-path>/<optional-path>The /outgoing/... pattern is the standard. Use a custom listener path only when an external system requires a specific path that cannot use the default shape.
Related
- Managed Agent reference: The primary upstream destination.
- Variants reference: Per-variant snapshot configuration.
- MCP surface starter: Step-by-step guide for configuring a transit point.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.