ACLs3

Add-Ons4

API4

API Documentation4

API Implementation3

API Product Documentation4

API Product Version Specification4

API Product Versions4

API Products4

API Publication3

API Specification4

API Version4

API-keys3

App Auth Strategies4

Application Registrations4

Applications4

Assets4

Audit Logs7

Auth Server4

Auth Server Claims4

Auth Server Clients8

Auth Server Scopes4

Auth Settings9

Basic-auth credentials3

CA Certificates4

Catalog Services4

Centrally Managed Consumers4

Centrally Managed Keys3

Certificates4

Cloned Plugins4

CMEK3

Config Store Secrets4

Config Stores4

Consumer Groups6

Consumers4

Control Plane Groups2

Control Planes6

Custom Domains3

Custom Plugin Schemas4

CustomPlugins4

Data-Plane Group Configurations2

DCR Providers4

DP Certificates4

Event Gateway Backend Clusters4

Event Gateway DataPlane Certificates4

Event Gateway Listener Policies8

Event Gateway Listeners4

Event Gateway Schema Registries4

Event Gateway Static Keys3

Event Gateway TLS Trust Bundles4

Event Gateway Virtual Cluster Consume Policies20

Event Gateway Virtual Cluster Policies4

Event Gateway Virtual Cluster Produce Policies16

Event Gateway Virtual Clusters4

Event Gateways4

GraphQL Cost Decorations1

HMAC-auth credentials3

Integration Instance Auth Config3

Integration Instance Auth Credentials3

Integration Instances4

JWTs3

Keys4

KeySets4

Mesh5

MTLS-auth credentials3

Networks5

Pages4

Partials4

Personal Access Tokens2

Platform IPs1

Plugins449

Portal Appearance2

Portal Audit Logs3

Portal Auth Settings9

Portal Custom Domains4

Portal Customization2

Portal Developers4

Portal Product Versions3

Portal Team Roles2

Portal Teams4

Portals10

Portals IP Allow List4

Private DNS3

Provider Accounts1

Realms4

Roles6

Routes8

Serverless Cloud Gateways3

Services4

Snippets4

SNIs4

System Accounts5

System Accounts - Access Tokens4

System Accounts - Roles3

System Accounts - Team Membership2

Targets3

Team Membership2

Teams5

Transit Gateways4

Upstreams4

Vaults4

patchReset Auth Settings

Event Gateway Virtual Clusters

Create Virtual Cluster

Creates a new virtual cluster associated with the specified Event Gateway.

post/v1/event-gateways/{gatewayId}/virtual-clusters

Request body

namestring required

The name of the virtual cluster.

descriptionstring

A human-readable description of the virtual cluster.

acl_mode'enforce_on_gateway' | 'passthrough' required

Configures whether or not ACL policies are enforced on the gateway.

enforce_on_gateway means the gateway enforces its own ACL policies for this virtual cluster and does not forward ACL-related commands to the backend cluster. Note that if there are no ACL policies configured, all access is denied.
passthrough tells the gateway to forward all ACL-related commands.

dns_labelstring required

The DNS label used in the bootstrap server URL to identify the virtual cluster when using SNI routing. The format follows the RFC1035: 1-63 chars, lowercase alphanumeric or '-', must start and end with an alphanumeric character.

labelsLabels

Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types.

Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".

Example request

{
  "authentication": [
    {
      "principals": [
        {
          "password": "${vault.env['MY_ENV_VAR']}"
        }
      ]
    }
  ],
  "dns_label": "vcluster-1",
  "labels": {
    "env": "test"
  }
}

Response

Created

idstring uuid required

The unique identifier of the virtual cluster.

descriptionstring

A human-readable description of the virtual cluster.

namestring required

The name of the virtual cluster.

dns_labelstring required

acl_mode'enforce_on_gateway' | 'passthrough' required

Configures whether or not ACL policies are enforced on the gateway.

enforce_on_gateway means the gateway enforces its own ACL policies for this virtual cluster and does not forward ACL-related commands to the backend cluster. Note that if there are no ACL policies configured, all access is denied.
passthrough tells the gateway to forward all ACL-related commands.

labelsLabels

Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types.

Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".

created_atstring date-time required

An ISO-8601 timestamp representation of entity creation date.

updated_atstring date-time required

An ISO-8601 timestamp representation of entity update date.

Example response

{
  "authentication": [
    {
      "principals": [
        {
          "password": "${vault.env['MY_ENV_VAR']}"
        }
      ]
    }
  ],
  "dns_label": "vcluster-1",
  "labels": {
    "env": "test"
  },
  "created_at": "2022-11-04T20:10:06.927Z",
  "updated_at": "2022-11-04T20:10:06.927Z"
}

Changes

Changed in 5 of the 52 revisions of this API.215

Jul 6, 202636da5cb9a6748See the full diff
- ○
  added the new optional request property authentication/items/oneOf[VirtualClusterAuthenticationClientCertificate]/fetch_kong_identity_principal
  new-optional-request-property
- ○
  added the new optional request property authentication/items/oneOf[VirtualClusterAuthenticationOauthBearer]/fetch_kong_identity_principal
  new-optional-request-property
- ○
  added the new optional request property authentication/items/oneOf[VirtualClusterAuthenticationSaslPlain]/fetch_kong_identity_principal
  new-optional-request-property
- ○
  added the new optional request property authentication/items/oneOf[VirtualClusterAuthenticationSaslScram]/fetch_kong_identity_principal
  new-optional-request-property
- ○
  added the optional property authentication/items/oneOf[VirtualClusterAuthenticationClientCertificate]/fetch_kong_identity_principal to the response with the 201 status
  response-optional-property-added
- ○
  added the optional property authentication/items/oneOf[VirtualClusterAuthenticationOauthBearer]/fetch_kong_identity_principal to the response with the 201 status
  response-optional-property-added
- ○
  added the optional property authentication/items/oneOf[VirtualClusterAuthenticationSaslPlainSensitiveDataAware]/fetch_kong_identity_principal to the response with the 201 status
  response-optional-property-added
- ○
  added the optional property authentication/items/oneOf[VirtualClusterAuthenticationSaslScram]/fetch_kong_identity_principal to the response with the 201 status
  response-optional-property-added
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Jun 26, 20264a39c7f8550911See the full diff
- ▲
  the response property topic_aliases became nullable for the status 201
  response-property-became-nullable
- ○
  the request property topic_aliases became nullable
  request-property-became-nullable
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
May 6, 20261f9c36d98f8d2See the full diff
- ○
  added the new optional request property topic_aliases
  new-optional-request-property
- ○
  added the optional property topic_aliases to the response with the 201 status
  response-optional-property-added
This revision also has 2 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Mar 27, 2026aad4daa45eee13See the full diff
- ▲
  added VirtualClusterAuthenticationClientCertificate to the authentication/items/ response property oneOf list for the response status 201
  response-property-one-of-added
- ○
  added client_certificate discriminator mapping keys to the authentication/items/ request property
  request-property-discriminator-mapping-added
- ○
  added VirtualClusterAuthenticationClientCertificate to the authentication/items/ request property oneOf list
  request-property-one-of-added
- ○
  added client_certificate discriminator mapping keys to the authentication/items/ response property for the response status 201
  response-property-discriminator-mapping-added
Feb 16, 20262b2a72c67bd21See the full diff
- ○
  endpoint added
  endpoint-added

Full history