# Transit Points

> Field reference for Transit Points: shared settings and per-destination configuration for agent-initiated outbound routes on an Agent Surface.
Transit Points define the agent-initiated outbound routes on a surface: the destinations the managed agent is allowed to call through the gateway. The managed agent calls the transit listener; the gateway forwards the call to the configured external endpoint.

## Shared settings

| Field | Type | Required | Default | Description |
| Outbound Listener Address | string | No | None | Separate listen address for the outbound listener. When absent, transit shares the access point’s listen address. |

Named outbound destinations are added, reordered, and removed via the canvas. The following shared settings apply to all transit points on the surface.

### Shared transit fields

| Field | Type | Required | Default | Description |
| Transit Token Mode | [Transit token mode](#transit-token-mode-options) | No | Embedded | How caller context is carried in transit tokens. |
| Transit Policy ID | [Policy definition](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/surface-reference.md#policy-definition) | No | None | Global OPA policy evaluated on all outbound calls before dispatch. |
| Outbound Rate Limit | [Rate limit](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/surface-reference.md#rate-limit) | No | None | Total outbound rate limit applied across all transit points. |
| Sign every outbound request | bool | No | true | Inject a signed VP into every outbound request. |
| Workload Binding | WorkloadBindingConfig | No | None | Controls which fields appear in signed VPs. |
| Extension Validation | ExtensionRules | No | None | Schema validation applied to outbound request bodies. |
| Custom Metadata | CustomMetadata | No | None | Custom metadata injected into outbound requests. |
| Extension Validation (response) | ExtensionRules | No | None | Schema validation applied to transit response bodies. |
| Trust Registry | TrustRegistryVerificationConfig | No | None | Verifies transit targets against a trust registry. |
| Authentication Method | SourceAuthConfig | No | None | Source authentication for the transit listener (authenticates the protected agent calling out). |

### Transit token mode options

| Mode | Behaviour |
| Embedded | Caller context is encrypted into the token itself. Stateless but produces larger tokens. Default. |
| Reference | Caller context is stored server-side; the token is a short reference key. Smaller tokens but requires server state. |

## Transit Point configuration

A single named outbound destination. Each transit point is reachable at:

```text
https:///outgoing///
```

Or at a custom path when listen_path is set on the transit point.

| Field | Type | Required | Default | Description |
| Transit Point ID | string (UUID) | No | Auto-generated | Stable internal identifier. Used by the task monitor and metrics store. Never appears in URLs. |
| Name | string | No | "" | Friendly display name. Drives the auto-derived alias shown as “Routing alias derived from the name above”. |
| Routing alias | string | Yes | — | URL-safe routing identifier (derived from name). Must match ^[a-z][a-z0-9-]*$ (lowercase, digits, dashes; must start with a letter). Forms the path segment in the outbound URL. Must be unique within the surface. |
| Target Endpoint | string | Yes | — | The external destination endpoint. Accepts https:// URLs. Shown under the Destination section. |
| Destination protocol | string | No | A2A / UCP | Protocol spoken by the destination. Can differ from the access point protocol. Options: A2A / UCP, AP2, MCP, MPX, DIDComm. |
| Authentication | TargetAuthConfig | No | None | Credentials injected into outbound requests to this destination. |
| Policy Definition | [Policy definition](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/surface-reference.md#policy-definition) | No | None | Per-destination OPA policy evaluated before dispatch. |
| Policy Definition (response) | [Policy definition](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/surface-reference.md#policy-definition) | No | None | Per-destination OPA policy evaluated on the response before forwarding back. Independent of the target response_policy. |
| Payment | TransitPaymentPolicy | No | None | Payment requirements if the destination charges. |
| Networking | [Networking](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/target.md#networking) | No | None | Timeout, retry, and circuit breaker configuration for this destination. |
| Rate Limit | [Rate limit](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/surface-reference.md#rate-limit) | No | None | Per-destination rate limit. Applied before dispatch to this endpoint. The transit-shared and surface-wide limits still apply independently. |
| Agent Identity | [Identity injection](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/target.md#identity-injection) | No | {} | VP signing and identity extraction for outbound requests to this destination. |
| Transit Point identity | ManagedIdentityConfig | No | None | Identity extraction from this transit point’s response. When set, overrides the surface-level external identity slot for this transit point only. |
| Transit Credentials | TransitCredentials | No | None | OAuth or API token management for this destination. |
| Agent Card Location | string | No | None | Override for the agent card path at the destination. Independent of the access point’s agent_card_path. Defaults to /.well-known/agent-card.json when absent. |

## URL patterns

The outbound URL shape depends on whether a custom listener path is set on the transit point.

### Default path

```text
https:///outgoing///
```

### Custom listener path

```text
https:////
```

The /outgoing/... pattern is the standard. Use a custom listener path only when an external system requires a specific path that cannot use the default shape.

## Related

- [Target reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/target.md): The primary inbound target.

- [Variants reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/variants.md): Per-variant transit overrides.

- [MCP surface starter](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/mcp-surface-starter.md): Step-by-step guide for configuring a transit point.