Transit Points
Transit Points define the agent-initiated outbound routes on a surface: the destinations the managed agent is allowed to call through the gateway. The managed agent calls the transit listener. The gateway forwards the call to the configured external endpoint. Use this reference when adding outbound destinations to a surface to understand routing alias requirements and per-destination policy, rate limit, and payment settings.
Transit Point configuration
A single named outbound destination. Configure routing and authentication using the panel settings below. Drop canvas elements on the transit point edge to add capabilities per destination. The same elements available on Access Point and Managed Agent edges apply here, scoped to this destination only.
Each transit point is reachable at:
https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>/<optional-path>Or at a custom path when listen_path is set on the transit point.
Panel settings
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Name | string | No | “Transit Point” | Display name shown on the canvas node and in the dashboard. Determines the Routing alias. |
| Listen Address (Host:Port) | dropdown | Yes | — | Outbound listener host and port for this transit point. Selected from configured outbound listeners. Hidden when the gateway has a single outbound address, as on Affinidi-hosted gateways, and the Transit Point uses that address. |
| Surface Prefix | dropdown | Yes | — | Path prefix for the listener URL. Selected from configured surface prefixes. |
| Custom Path | string | Yes | Auto-generated | Path suffix appended after the surface prefix. Auto-generated as a random path on first drop; editable. |
| Listener URL | string | Read-only | Derived | Assembled outbound listener URL. Read-only banner. |
| Routing alias | string | Read-only | Derived | Derived from the Name field. Forms the path segment in the standard outbound URL: https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>. Must match ^[a-z][a-z0-9-]*$. |
| Endpoint Type | select | Yes | Direct URL | Where this Transit Point sends requests. Options: Direct URL (an external https:// endpoint) or via Gateway Connection (an Agent Surface on a connected gateway, reached over Fabric). |
| Target Endpoint | string | Yes (Direct URL) | — | External destination URL, for example https://api.example.com. Shown when Endpoint Type is Direct URL. |
| Gateway / Agent Surface on Gateway | select | Yes (via Gateway Connection) | — | The connected gateway and the Agent Surface on it to route to. The surface list shows only surfaces whose protocol matches this Transit Point. Selecting a surface builds a fabric:// endpoint automatically. |
| Override Agent Card Location | toggle | No | Off | When on, overrides the default agent card path for this destination. A2A destinations only. |
| Agent Card Location | string | No | .well-known/agent-card.json | Custom agent card path relative to the destination base URL. Shown only when Override Agent Card Location is on. |
| Target Authentication | select | No | None | Service-level credentials injected into outbound requests. Options: None, Bearer Token, API Key Header, Custom Header, OAuth Client Credentials. |
| Secret Reference | select | No (Yes for OAuth Client Credentials) | — | The stored secret supplying the credential value for the selected Target Authentication option. |
| Fallback when secret missing | select | No | Reject (502) | What happens if the referenced secret can’t be resolved at request time. Options: Reject (502) or Passthrough (no credential injected). |
| Inject outbound credential | toggle | No | Off | When on, pulls a credential from a configured provider and attaches it to every outbound request through this transit point. Expands to show Credential Provider, Scopes, Consent Mode, and Inject As fields. Each Transit Point’s credential applies to that Transit Point alone. Once the surface has Credential Delegation bindings, the gateway uses those in place of this credential, as described in Delegated credentials on a Transit Point. |
| Require transit token | toggle | No | On | When on, every call to this transit point must carry a valid X-Transit-Token header issued by the surface’s Access Point. |
Delegated credentials on a Transit Point
A Transit Point attaches a delegated credential from one of two sources:
- When the surface has a Credential Delegation element with bindings, every Transit Point on the surface uses the bindings whose Required For is All outbound requests. A binding set to Specific MCP tools only applies to calls to the surface’s Target alone, because a partner upstream names its own tools.
- When the surface has no Credential Delegation bindings, each Transit Point uses only the credential from its own Inject outbound credential setting.
Give a binding All outbound requests only when every Transit Point’s upstream on the surface should receive that credential.
Fabric routes
A Delegated Credentials section appears in this panel when Endpoint Type is via Gateway Connection and the Transit Point has a delegated credential to send: the surface has Credential Delegation bindings, or this Transit Point has Inject outbound credential turned on with a provider selected.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Send delegated credentials over Fabric | switch | No | Off | When on, the caller’s delegated access token is sent to the remote gateway with each request through this Transit Point, on every protocol, and the panel warns that the token is sent to the named receiving gateway. When off, the remote gateway receives no delegated credential. The caller’s own token is always removed before the request crosses Fabric, and the refresh token stays on this gateway. |
Turn the switch on only for remote gateways you trust with the caller’s access token. The same switch appears on the Managed Agent panel for a fabric:// Target; see Managed Agent.
Send delegated credentials over Fabric is off unless it is turned on for a Transit Point, including on existing fabric:// Transit Points. If the remote gateway relies on receiving the caller’s delegated token, turn the switch on for that Transit Point and save the surface.
Canvas elements
Drop these elements on the transit point edge in the canvas builder. For the complete field reference for each element, see the linked page.
| Element | Reference | Behaviour at this position |
|---|---|---|
| Policy | OPA policies: Policy element | OPA policy evaluated on requests to this destination before dispatch. |
| Policy (response) | OPA policies: Policy element | OPA policy evaluated on the response from this destination before forwarding back. |
| Rate Limit | Networking elements: Rate Limit | Per-destination request cap. |
| Trust Registry | Trust registries | Verifies this transit destination against a trust registry before forwarding. |
| Agent Identity | Identity element | VP signing and identity extraction for outbound requests to this destination. |
| Transit Point identity | Identity element | Identity extraction from this destination’s response. When set, overrides the surface-level external identity slot for this transit point only. |
| Workload Binding | Outbound binding elements: Workload Binding | Caller workload identity claims in signed VPs for this destination. |
| Networking | Networking elements | Timeout, retry, and circuit breaker for this destination. |
| Payment | Payment element | Payment requirements if this destination charges. |
| Metadata Extraction | Metadata elements | Outbound header mapping from the managed agent’s request. A2A destinations only. |
URL patterns
The outbound URL shape depends on whether a custom listener path is set on the transit point.
Default path
https://<GATEWAY_HOST>/outgoing/<surface-route>/<alias>/<optional-path>Custom listener path
https://<GATEWAY_HOST>/<custom-path>/<optional-path>The /outgoing/... pattern is the standard. Use a custom listener path only when an external system requires a specific path that cannot use the default shape.
Related
- Managed Agent reference: The primary upstream destination.
- Variants reference: Per-variant snapshot configuration.
- MCP surface starter: Step-by-step guide for configuring a transit point.
Glad to hear it. Thanks for letting us know.
Sorry to hear that. Thanks for letting us know.