--- title: "POST /gateway-get-config" method: POST path: "/gateway-get-config" tags: ["Gateway"] --- # POST /gateway-get-config `POST /gateway-get-config` ## Request - Base URL: `https://api.akeyless.io` - URL: `https://api.akeyless.io/gateway-get-config` - Auth: none declared ## Request body - GatewayGetConfig: gatewayGetConfig is a command that returns gateway configuration - `json` boolean: Set output format to JSON - `token` string: Authentication token (see `/auth` and `/configure`) - `uid-token` string: The universal identity token, Required only for universal_identity authentication ## Response `200` gatewayGetConfigResponse wraps response body. - AkeylessGatewayConfig - `admins` AdminsConfigPart - `admins_migration_status` integer - `allowed_access` object - `ai_insights` AiInsightsConfigPart: TargetId/TargetName/Model predate multi-model support and are retained for backward compatibility in both directions - they mirror the Default entry on write, and are adopted as a synthesized Default entry on read when Models is empty. See EffectiveModels and syncLegacyFields in types_ai_insights_config.go, where all the model-list behavior lives. - `enable` boolean - `model` string - `models` AiModelEntry[]: Models holds every configured model, in whatever order and with whatever Default flag was stored - it is NOT canonicalized on write, so nothing may assume the Default sits at index 0. Empty on configs written before multi-model support. Never read it directly: use EffectiveModels for the list as stored (which also handles the legacy case), or PolicyModels for exactly one Default in row 1 followed by the Quorum models. - `model` string - `provider` string: Provider is display-only: it carries the provider label the model catalog reported for Model (meaningful for Bedrock, which fronts several providers) so the console can render its Provider column without re-fetching the whole catalog per row. Never used for credential resolution or validation - the target type is the authority there. - `role` string: A gateway has exactly one AiModelRoleDefault entry whenever any entry exists: it serves AI Insight, ISI, and the standard policy decisions in Secretless AI / ARA. AiModelRoleQuorum entries are consulted alongside the default to double-check policy decisions before a risky action is allowed. - `target_id` integer: TargetId uses the repo-wide spelling (see types.Target.TargetId and AiInsightsConfigPart.TargetId) rather than the Go-idiomatic TargetID. - `target_name` string - `target_type` string: TargetType is display-only, captured at write time like Provider. The console shows it as a read-only column; resolving it per row from the targets list instead would mean an extra lookup that can disagree with what the entry was created against. - `target_id` integer - `target_name` string - `version` integer: Version is an optimistic-concurrency token, bumped by gator on every accepted write. Every mutation of this part is a read-modify-write across the network (the gateway reads the whole part, edits one entry, writes it back), and the write replaces the part wholesale. Without a token, two admins adding a quorum model at the same time silently lose one of the two - which, since the list must always carry exactly one Default, can also change which model serves every other AI feature. Zero means "unversioned": a client that predates this field, whose write gator accepts rather than rejecting outright. See updateGatewayAiInsightsConfig. - `ca_certificates` CaCertificatesConfigPart - `certificate_store` CertificateStore[] - `certificate_pem` string - `common_name` string - `expiration_date` string, date-time - `expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `name` string - `cache` CacheConfigPart - `cache_enable` boolean - `cache_encryption_key` string - `cache_ttl` string - `new_proactive_cache_enable` boolean - `proactive_cache_dump_interval` string - `proactive_cache_enable` boolean - `proactive_cache_minimum_fetching_time` string - `cf` CFConfigPart - `customer_fragements` object - `config_protection_key_name` string - `general` GeneralConfigPart - `akeyless_url` string: AkeylessUrl is here for BC only. Gator will still return it if it exists in the configuration, but new clients (>=2.34.0) will ignore it and override it with what exists in their local file. It will no longer be sent to Gator for update, so new clusters will only have the default value saved in the DB. - `api_token_ttl` string - `display_name` string - `enable_json_body_limit` boolean - `enable_sni_proxy` boolean - `enable_tls` boolean - `enable_tls_configure` boolean - `enable_tls_curl` boolean - `enable_tls_hvp` boolean - `gw_cluster_url` string - `hvp_route_version` integer - `json_body_limit_mb` integer - `notify_on_status_change` boolean - `tcp_port` string - `tls_cert` string - `tls_cert_common_name` string - `tls_cert_expiration_date` string, date-time - `tls_cert_expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `tls_key` string - `k8s_auths` K8SAuthsConfigPart - `k8s_auths` K8SAuth[] - `am_token_expiration` integer: AuthMethodTokenExpiration is time in seconds of expiration of the Akeyless Kube Auth Method token - `auth_method_access_id` string: AuthMethodAccessId of the Kubernetes auth method - `auth_method_prv_key_pem` string: AuthMethodSigningKey is the private key (in base64 of the PEM format) associated with the public key defined in the Kubernetes auth method, that used to sign the internal token for the Akeyless Kubernetes Auth Method - `cluster_api_type` string: ClusterApiType defines types of API access to cluster - `disable_iss_validation` boolean: DisableISSValidation is optional parameter to disable ISS validation - `id` string - `k8s_auth_type` string - `k8s_ca_cert` string: K8SCACert is the CA Cert to use to call into the kubernetes API - `k8s_client_cert_data` string: K8sClientCertData is the client certificate for k8s client certificate authentication - `k8s_client_key_data` string: K8sClientKeyData is the client key for k8s client certificate authentication - `k8s_host` string: K8SHost is the url string for the kubernetes API - `k8s_issuer` string: K8SIssuer is the claim that specifies who issued the Kubernetes token - `k8s_pub_keys_pem` string[]: K8SPublicKeysPEM is the list of public key in PEM format - `k8s_token_reviewer_jwt` string: K8STokenReviewerJWT is the bearer for clusterApiTypeK8s, used during TokenReview API call - `name` string - `rancher_api_key` string: RancherApiKey the bear token for clusterApiTypeRancher - `rancher_cluster_id` string: RancherClusterId cluster id as define in rancher (in case of clusterApiTypeRancher) - `use_local_ca_jwt` boolean: UseLocalCAJwt is an optional parameter to set defaulting to using the local service account when running in a Kubernetes pod - `kerberos` KerberosConfigPart - `kerberos_access_id` string - `kerberos_keytab` string - `kerberos_krb_5_conf` string - `kerberos_private_key` string - `ldap_anonymous_search` boolean - `ldap_bind_dn` string - `ldap_bind_password` string - `ldap_cert` string - `ldap_group_attr` string - `ldap_group_dn` string - `ldap_group_filter` string - `ldap_url` string - `ldap_user_attr` string - `ldap_user_dn` string - `kmip_clients` KMIPConfigPart - `clients` object - `key_enc` integer[]: Saves the private key of the cert issuer in encypted form - `server` KMIPServer - `active` boolean - `ca` integer[] - `cas` KMIPCA[] - `certificate` integer[] - `certificate_issue_date` string, date-time - `certificate_ttl_in_seconds` integer - `created_at` string, date-time - `id` string - `issued_client_count` integer: IssuedClientCount is populated by gateway list-CA responses (computed, not persisted). - `key_enc` integer[] - `not_after` string, date-time - `not_before` string, date-time - `state` string - `certificate` integer[] - `certificate_issue_date` string, date-time - `certificate_ttl_in_seconds` integer - `expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `hostname` string - `root` string - `server_enc` integer[]: Saved for backward compatibility TODO: remove this after all clients upgrade - `ldap` LdapConfigPart - `ldap_access_id` string - `ldap_anonymous_search` boolean - `ldap_bind_dn` string - `ldap_bind_password` string - `ldap_cert` string - `ldap_enable` boolean - `ldap_group_attr` string - `ldap_group_dn` string - `ldap_group_filter` string - `ldap_private_key` string - `ldap_token_expiration` string - `ldap_url` string - `ldap_user_attr` string - `ldap_user_dn` string - `leadership` LeadershipConfigPart - `open_leadership` integer[] - `log_forwarding` LogForwardingConfigPart - `aws_s3_config` AwsS3LogForwardingConfig - `aws_access_id` string - `aws_access_key` string - `aws_auth_type` string - `aws_region` string - `aws_role_arn` string - `aws_use_gateway_cloud_identity` boolean: deprecated - `bucket_name` string - `log_folder` string - `azure_analytics_config` AzureLogAnalyticsForwardingConfig - `azure_enable_batch` string - `azure_workspace_id` string - `azure_workspace_key` string - `datadog_config` DatadogForwardingConfig - `datadog_api_key` string - `datadog_host` string - `datadog_log_service` string - `datadog_log_source` string - `datadog_log_tags` string - `elasticsearch_config` ElasticsearchLogForwardingConfig - `elasticsearch_api_key` string - `elasticsearch_auth_type` string - `elasticsearch_cloud_id` string - `elasticsearch_enable_tls` boolean - `elasticsearch_index` string - `elasticsearch_nodes` string - `elasticsearch_password` string - `elasticsearch_server_type` string - `elasticsearch_tls_certificate` string - `elasticsearch_user_name` string - `google_chronicle_config` GoogleChronicleForwardingConfig - `customer_id` string - `log_type` string - `region` string - `service_account_key` string - `json_output` boolean - `logan_enable` boolean - `logan_url` string - `logstash_config` LogstashLogForwardingConfig - `logstash_dns` string - `logstash_enable_tls` boolean - `logstash_protocol` string - `logstash_tls_certificate` string - `logz_io_config` LogzIoLogForwardingConfig - `target_logz_io_protocol` string - `target_logz_io_token` string - `pull_interval_sec` string - `splunk_config` SplunkLogForwardingConfig - `splunk_enable_batch` string - `splunk_enable_tls` boolean - `splunk_index` string - `splunk_source` string - `splunk_sourcetype` string - `splunk_tls_certificate` string - `splunk_token` string - `splunk_url` string - `sumo_logic_config` SumologicLogForwardingConfig - `sumo_logic_endpoint` string - `sumo_logic_host` string - `sumo_logic_tags` string - `syslog_config` SyslogLogForwardingConfig - `syslog_enable_tls` boolean - `syslog_formatter` string - `syslog_host` string - `syslog_network` string - `syslog_target_tag` string - `syslog_tls_certificate` string - `target_log_type` string - `message_queue_info` GatewayMessageQueueInfo - `broadcast_queue_name_a` string - `mq_type` string - `queue_name` string - `queue_url` string - `migrations` MigrationsConfigPart - `active_directory_migrations` ActiveDirectoryMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` ActiveDirectoryPayload - `active_directory_target_id` integer - `ai_certificate_discovery` boolean - `auto_rotate` boolean - `auto_rotate_interval_in_days` integer - `auto_rotate_rotation_hour` integer - `certificates_expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `certificates_path_template` string - `computer_base_dn` string - `discover_iis_apps` boolean - `discover_local_users` boolean: Deprecated - `discover_services` boolean - `discovery_types` DiscoveryType[] - `domain_name` string - `domain_server_targets_path_template` string - `domain_users_rotated_secrets_path_template` string - `enable_password_policy` boolean: EnablePasswordPolicy enables applying PasswordPolicy to newly created domain/local user rotated secrets. Pointer so omitted values are preserved on partial update (nil = not provided). - `enable_rdp_sra` boolean - `local_users_ignore_list` object - `local_users_rotated_secrets_path_template` string - `os_filter` string - `password_policy` PasswordPolicyInfo - `password_length` integer - `use_capital_letters` boolean - `use_lower_letters` boolean - `use_numbers` boolean - `use_special_characters` boolean - `skip_dry_run` boolean: SkipDryRun enables skip_dry_run on newly created domain/local user rotated secrets. Pointer so omitted values are preserved on partial update (nil = not provided). When false/unset, existing rotated-secret SkipDryRun values are left unchanged on sync. - `ssh_port` string - `target_format` string - `targets_type` string - `user_base_dn` string - `user_groups` string[] - `winrm_over_http` boolean - `winrm_port` string - `aws_secrets_migrations` AWSSecretsMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` AWSPayload - `key` string - `region` string - `secret` string - `azure_kv_migrations` AzureKeyVaultMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` AzurePayload - `client` string - `name` string - `secret` string - `tenant` string - `certificate_migrations` CertificateMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` CertificatePayload - `exclude_hosts` string[] - `expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `folder` string - `max_dial_timeout` integer - `max_scan_duration` integer - `max_workers` integer - `port_ranges` string - `targets` CertificateScanTarget[] - `host` string - `portRanges` string - `conjur_migrations` ConjurMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` ConjurPayload - `conjur_account` string - `conjur_api_key` string - `conjur_url` string - `conjur_username` string - `gcp_secrets_migrations` GCPSecretsMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` GCPPayload - `gcp_credentials_json` string - `project_id` string - `use_gw_cloud_identity` boolean - `hashi_migrations` HashiMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` HashiPayload - `delete_sync_on_deletion` boolean - `hashi_target_id` integer - `import_as_json` boolean - `metadata_mode` string - `namespaces` string[] - `token` string - `url` string - `usc_name` string - `k8s_migrations` K8SMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` K8SPayload - `ca` integer[] - `client_cert` integer[] - `client_key` integer[] - `namespace` string - `password` string - `server` string - `skip_system` boolean - `token` string - `username` string - `mock_migrations` MockMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` MockPayload - `vaults` string[] - `one_password_migrations` OnePasswordMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` OnePasswordPayload - `email` string - `password` string - `secret_key` string - `url` string - `vaults` string[] - `server_inventory_migrations` ServerInventoryMigration[] - `general` MigrationGeneral - `id` string - `last_migration` string - `last_modified` string, date-time - `message` string - `name` string - `new_name` string - `prefix` string - `protection_key` string - `schedule` string - `status` string - `type` string - `payload` ServerInventoryPayload - `auto_rotate` boolean - `auto_rotate_interval_in_days` integer - `auto_rotate_rotation_hour` integer - `enable_rdp_sra` boolean - `migration_target_id` integer - `server_targets_path_template` string - `user_groups` string[] - `users_ignore_list` object - `users_rotated_secrets_path_template` string - `producers` ProducersConfigPart - `producers` Producer[] - `active` boolean - `failure_message` string - `id` integer - `init` boolean - `name` string - `type` string - `rotators` RotatorsConfigPart - `rotators` Rotator[] - `id` integer - `last_error` string - `name` string - `rotation_interval` integer - `type` string - `saml` DefaultConfigPart - `certificate_access_id` string - `default_protection_key_id` integer - `default_secret_location` string - `oidc_access_id` string - `saml_access_id` string - `saml_sp` SamlSpConfigPart: Private key must never be returned on customer-facing config APIs. - `saml_sp_cert` string - `saml_sp_cert_common_name` string - `saml_sp_cert_expiration_date` string, date-time - `saml_sp_key` string - `saml_sp_key_generated_at` string, date-time - `version` integer ## Other responses - `default`: errorResponse wraps any error to return it as a JSON object with one "error" field. --- [API](https://skmtc.dev/akeyless/apis/infrastructure-connectivity.md) - [All operations](https://skmtc.dev/akeyless/apis/infrastructure-connectivity/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/infrastructure-connectivity/revisions/62dc62fea89d?raw)