--- title: "Returns MeshTrafficPermission entity" method: GET path: "/v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtrafficpermissions/{name}" tags: ["MeshTrafficPermission"] --- # Returns MeshTrafficPermission entity `GET /v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtrafficpermissions/{name}` ## Request - Base URL: `https://global.api.konghq.com` - URL: `https://global.api.konghq.com/v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtrafficpermissions/{name}` - Auth: one of: - HTTP bearer - HTTP bearer - HTTP bearer - HTTP bearer ## Path parameters - `mesh` string, required - `name` string, required ## Response `200` Successful response - MeshTrafficPermissionItem: MeshTrafficPermission controls which services are allowed to communicate with each other in the mesh. It provides fine-grained access control by allowing you to define allow/deny rules based on service identity, enabling zero-trust security and supporting shadow mode for testing permission changes before enforcement. - `type` 'MeshTrafficPermission', required: the type of the resource - `mesh` string: Mesh is the name of the Kuma mesh this resource belongs to. It may be omitted for cluster-scoped resources. - `kri` string: A unique identifier for this resource instance used by internal tooling and integrations. Typically derived from resource attributes and may be used for cross-references or indexing - `name` string, required: Name of the Kuma resource - `labels` object: The labels to help identity resources - `spec` object, required: Spec is the specification of the Kuma MeshTrafficPermission resource. - `from` object[]: From list makes a match between clients and corresponding configurations - `default` object: Default is a configuration specific to the group of clients referenced in 'targetRef' - `action` 'Allow' | 'Deny' | 'AllowWithShadowDeny': Action defines a behavior for the specified group of clients: - `targetRef` object, required: TargetRef is a reference to the resource that represents a group of clients. - `kind` 'Mesh' | 'MeshSubset' | 'MeshGateway' | 'MeshService' | 'MeshExternalService' | 'MeshMultiZoneService' | 'MeshServiceSubset' | 'MeshHTTPRoute' | 'Dataplane', required: Kind of the referenced resource - `labels` object: Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespace can be used. - `mesh` string: Mesh is reserved for future use to identify cross mesh resources. - `name` string: Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and `MeshGatewayRoute` - `namespace` string: Namespace specifies the namespace of target resource. If empty only resources in policy namespace will be targeted. - `proxyTypes` string[]: ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all data plane types are targeted by the policy. - `sectionName` string: SectionName is used to target specific section of resource. For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected. - `tags` object: Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshServiceSubset` - `rules` object[]: Rules defines inbound permissions configuration - `default` object, required - `allow` object[]: Allow definees a list of matches for which access will be allowed - `sni` object: SNI defines a matcher configuration for matching by SNI value carried on the TLS connection - `type` 'Exact', required: Type defines how to match traffic by SNI. Only `Exact` is supported. - `value` string, required: Value is the SNI carried on the TLS connection that needs to match for the configuration to be applied - `spiffeID` object: SpiffeID defines a matcher configuration for SpiffeID matching - `type` 'Exact' | 'Prefix', required: Type defines how to match incoming traffic by SpiffeID. `Exact` or `Prefix` are allowed. - `value` string, required: Value is SpiffeID of a client that needs to match for the configuration to be applied - `allowWithShadowDeny` object[]: AllowWithShadowDeny defines a list of matches for which access will be allowed but emits logs as if requests are denied - `sni` object: SNI defines a matcher configuration for matching by SNI value carried on the TLS connection - `type` 'Exact', required: Type defines how to match traffic by SNI. Only `Exact` is supported. - `value` string, required: Value is the SNI carried on the TLS connection that needs to match for the configuration to be applied - `spiffeID` object: SpiffeID defines a matcher configuration for SpiffeID matching - `type` 'Exact' | 'Prefix', required: Type defines how to match incoming traffic by SpiffeID. `Exact` or `Prefix` are allowed. - `value` string, required: Value is SpiffeID of a client that needs to match for the configuration to be applied - `deny` object[]: Deny defines a list of matches for which access will be denied - `sni` object: SNI defines a matcher configuration for matching by SNI value carried on the TLS connection - `type` 'Exact', required: Type defines how to match traffic by SNI. Only `Exact` is supported. - `value` string, required: Value is the SNI carried on the TLS connection that needs to match for the configuration to be applied - `spiffeID` object: SpiffeID defines a matcher configuration for SpiffeID matching - `type` 'Exact' | 'Prefix', required: Type defines how to match incoming traffic by SpiffeID. `Exact` or `Prefix` are allowed. - `value` string, required: Value is SpiffeID of a client that needs to match for the configuration to be applied - `targetRef` object: TargetRef is a reference to the resource the policy takes an effect on. The resource could be either a real store object or virtual resource defined inplace. - `kind` 'Mesh' | 'MeshSubset' | 'MeshGateway' | 'MeshService' | 'MeshExternalService' | 'MeshMultiZoneService' | 'MeshServiceSubset' | 'MeshHTTPRoute' | 'Dataplane', required: Kind of the referenced resource - `labels` object: Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespace can be used. - `mesh` string: Mesh is reserved for future use to identify cross mesh resources. - `name` string: Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and `MeshGatewayRoute` - `namespace` string: Namespace specifies the namespace of target resource. If empty only resources in policy namespace will be targeted. - `proxyTypes` string[]: ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all data plane types are targeted by the policy. - `sectionName` string: SectionName is used to target specific section of resource. For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected. - `tags` object: Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshServiceSubset` - `creationTime` string, date-time: Time at which the resource was created - `modificationTime` string, date-time: Time at which the resource was updated ## Other responses - `404`: Not Found ## Changes - **2026-08-18** `658ffb748f95`: 3 info - added the optional property `spec/rules/items/default/allow/items/sni` to the response with the `200` status - added the optional property `spec/rules/items/default/allowWithShadowDeny/items/sni` to the response with the `200` status - added the optional property `spec/rules/items/default/deny/items/sni` to the response with the `200` status - **2025-11-06** `5d2b35832e3f`: 1 info - added the optional property `kri` to the response with the `200` status - **2025-10-02** `ecce2daf9de6`: 1 info - added the optional property `spec/rules` to the response with the `200` status - **2025-08-12** `b2800570b3e2`: 1 info - endpoint added [Operation history](https://skmtc.dev/kong/apis/konnect-api-beta/changes/v1/mesh/control-planes/:cpId/api/meshes/:mesh/meshtrafficpermissions/:name/get.md) --- [API](https://skmtc.dev/kong/apis/konnect-api-beta.md) - [All operations](https://skmtc.dev/kong/apis/konnect-api-beta/llms.txt) - [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-beta/revisions/cef0f947e9c9?raw)