---
title: "Export workload configuration"
method: GET
path: "/api/v1beta/workloads/{name}/export"
tags: ["workloads"]
---

# Export workload configuration

`GET /api/v1beta/workloads/{name}/export`

Export a workload's run configuration as JSON

## Path parameters

- `name` string, required

## Response `200`

OK

- RunnerRunConfig
  - `audit_config` AuditConfig — DEPRECATED: Middleware configuration. AuditConfig contains the audit logging configuration
    - `component` string — Component is the component name to use in audit events. +optional
    - `enabled` boolean — Enabled controls whether audit logging is enabled. When true, enables audit logging with the configured options. +kubebuilder:default=false +optional
    - `eventTypes` string[] — EventTypes specifies which event types to audit. If empty, all events are audited. +optional
    - `excludeEventTypes` string[] — ExcludeEventTypes specifies which event types to exclude from auditing. This takes precedence over EventTypes. +optional
    - `includeRequestData` boolean — IncludeRequestData determines whether to include request data in audit logs. +kubebuilder:default=false +optional
    - `includeResponseData` boolean — IncludeResponseData determines whether to include response data in audit logs. +kubebuilder:default=false +optional
    - `logFile` string — LogFile specifies the file path for audit logs. If empty, logs to stdout. +optional
    - `maxDataSize` integer — MaxDataSize limits the size of request/response data included in audit logs (in bytes). +kubebuilder:default=1024 +optional
  - `audit_config_path` string — DEPRECATED: Middleware configuration. AuditConfigPath is the path to the audit configuration file
  - `authz_config` AuthzConfig — DEPRECATED: Middleware configuration. AuthzConfig contains the authorization configuration
    - `type` string — Type is the type of authorization configuration (e.g., "cedarv1").
    - `version` string — Version is the version of the configuration format.
  - `authz_config_path` string — DEPRECATED: Middleware configuration. AuthzConfigPath is the path to the authorization configuration file
  - `base_name` string — BaseName is the base name used for the container (without prefixes)
  - `cmd_args` string[] — CmdArgs are the arguments to pass to the container
  - `container_labels` object — ContainerLabels are the labels to apply to the container
  - `container_name` string — ContainerName is the name of the container
  - `debug` boolean — Debug indicates whether debug mode is enabled
  - `endpoint_prefix` string — EndpointPrefix is an explicit prefix to prepend to SSE endpoint URLs. This is used to handle path-based ingress routing scenarios.
  - `env_file_dir` string — DEPRECATED: No longer appears to be used. EnvFileDir is the directory path to load environment files from
  - `env_vars` object — EnvVars are the parsed environment variables as key-value pairs
  - `group` string — Group is the name of the group this workload belongs to, if any
  - `header_forward` RunnerHeaderForwardConfig — HeaderForward contains configuration for injecting headers into requests to remote servers.
    - `add_headers_from_secret` object — AddHeadersFromSecret is a map of header names to secret names. The key is the header name, the value is the secret name in ToolHive's secrets manager. Resolved at runtime via WithSecrets() into resolvedHeaders. The actual secret value is only held in memory, never persisted.
    - `add_plaintext_headers` object — AddPlaintextHeaders is a map of header names to literal values to inject into requests. WARNING: These values are stored in plaintext in the configuration. For sensitive values (API keys, tokens), use AddHeadersFromSecret instead.
  - `host` string — Host is the host for the HTTP proxy
  - `ignore_config` IgnoreConfig — IgnoreConfig contains configuration for ignore processing
    - `loadGlobal` boolean — Whether to load global ignore patterns
    - `printOverlays` boolean — Whether to print resolved overlay paths for debugging
  - `image` string — Image is the Docker image to run
  - `isolate_network` boolean — IsolateNetwork indicates whether to isolate the network for the container
  - `jwks_auth_token_file` string — DEPRECATED: No longer appears to be used. JWKSAuthTokenFile is the path to file containing auth token for JWKS/OIDC requests
  - `k8s_pod_template_patch` string — K8sPodTemplatePatch is a JSON string to patch the Kubernetes pod template Only applicable when using Kubernetes runtime
  - `middleware_configs` TypesMiddlewareConfig[] — MiddlewareConfigs contains the list of middleware to apply to the transport and the configuration for each middleware.
    - `parameters` object — Parameters is a JSON object containing the middleware parameters. It is stored as a raw message to allow flexible parameter types.
    - `type` string — Type is a string representing the middleware type.
  - `name` string — Name is the name of the MCP server
  - `oidc_config` AuthTokenValidatorConfig — DEPRECATED: Middleware configuration. OIDCConfig contains OIDC configuration
    - `allowPrivateIP` boolean — AllowPrivateIP allows JWKS/OIDC endpoints on private IP addresses
    - `audience` string — Audience is the expected audience for the token
    - `authTokenFile` string — AuthTokenFile is the path to file containing bearer token for authentication
    - `cacertPath` string — CACertPath is the path to the CA certificate bundle for HTTPS requests
    - `clientID` string — ClientID is the OIDC client ID
    - `clientSecret` string — ClientSecret is the optional OIDC client secret for introspection
    - `insecureAllowHTTP` boolean — InsecureAllowHTTP allows HTTP (non-HTTPS) OIDC issuers for development/testing WARNING: This is insecure and should NEVER be used in production
    - `introspectionURL` string — IntrospectionURL is the optional introspection endpoint for validating tokens
    - `issuer` string — Issuer is the OIDC issuer URL (e.g., https://accounts.google.com)
    - `jwksurl` string — JWKSURL is the URL to fetch the JWKS from
    - `resourceURL` string — ResourceURL is the explicit resource URL for OAuth discovery (RFC 9728)
    - `scopes` string[] — Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728) If empty, defaults to ["openid"]
  - `permission_profile` PermissionsProfile — PermissionProfile is the permission profile to use
    - `name` string — Name is the name of the profile
    - `network` PermissionsNetworkPermissions — Network defines network permissions
      - `inbound` PermissionsInboundNetworkPermissions — Inbound defines inbound network permissions
        - `allow_host` string[] — AllowHost is a list of allowed hosts for inbound connections
      - `mode` string — Mode specifies the network mode for the container (e.g., "host", "bridge", "none") When empty, the default container runtime network mode is used
      - `outbound` PermissionsOutboundNetworkPermissions — Outbound defines outbound network permissions
        - `allow_host` string[] — AllowHost is a list of allowed hosts
        - `allow_port` integer[] — AllowPort is a list of allowed ports
        - `insecure_allow_all` boolean — InsecureAllowAll allows all outbound network connections
    - `privileged` boolean — Privileged indicates whether the container should run in privileged mode When true, the container has access to all host devices and capabilities Use with extreme caution as this removes most security isolation
    - `read` string[] — Read is a list of mount declarations that the container can read from These can be in the following formats: - A single path: The same path will be mounted from host to container - host-path:container-path: Different paths for host and container - resource-uri:container-path: Mount a resource identified by URI to a container path
    - `write` string[] — Write is a list of mount declarations that the container can write to These follow the same format as Read mounts but with write permissions
  - `permission_profile_name_or_path` string — PermissionProfileNameOrPath is the name or path of the permission profile
  - `port` integer — Port is the port for the HTTP proxy to listen on (host port)
  - `proxy_mode` 'sse' | 'streamable-http' — ProxyMode is the proxy mode for stdio transport ("sse" or "streamable-http") Note: "sse" is deprecated; use "streamable-http" instead.
  - `remote_auth_config` RemoteConfig — RemoteAuthConfig contains OAuth configuration for remote MCP servers
    - `authorize_url` string
    - `bearer_token` string — Bearer token configuration (alternative to OAuth)
    - `bearer_token_file` string
    - `cached_refresh_token_ref` string — Cached OAuth token reference for persistence across restarts. The refresh token is stored securely in the secret manager, and this field contains the reference to retrieve it (e.g., "OAUTH_REFRESH_TOKEN_workload"). This enables session restoration without requiring a new browser-based login.
    - `cached_token_expiry` string
    - `callback_port` integer
    - `client_id` string
    - `client_secret` string
    - `client_secret_file` string
    - `env_vars` RegistryEnvVar[] — Environment variables for the client
      - `default` string — Default is the value to use if the environment variable is not explicitly provided Only used for non-required variables
      - `description` string — Description is a human-readable explanation of the variable's purpose
      - `name` string — Name is the environment variable name (e.g., API_KEY)
      - `required` boolean — Required indicates whether this environment variable must be provided If true and not provided via command line or secrets, the user will be prompted for a value
      - `secret` boolean — Secret indicates whether this environment variable contains sensitive information If true, the value will be stored as a secret rather than as a plain environment variable
    - `headers` RegistryHeader[] — Headers for HTTP requests
      - `choices` string[] — Choices provides a list of valid values for the header (optional)
      - `default` string — Default is the value to use if the header is not explicitly provided Only used for non-required headers
      - `description` string — Description is a human-readable explanation of the header's purpose
      - `name` string — Name is the header name (e.g., X-API-Key, Authorization)
      - `required` boolean — Required indicates whether this header must be provided If true and not provided via command line or secrets, the user will be prompted for a value
      - `secret` boolean — Secret indicates whether this header contains sensitive information If true, the value will be stored as a secret rather than as plain text
    - `issuer` string — OAuth endpoint configuration (from registry)
    - `oauth_params` object — OAuth parameters for server-specific customization
    - `resource` string — Resource is the OAuth 2.0 resource indicator (RFC 8707).
    - `scopes` string[]
    - `skip_browser` boolean
    - `timeout` string
    - `token_url` string
    - `use_pkce` boolean
  - `remote_url` string — RemoteURL is the URL of the remote MCP server (if running remotely)
  - `schema_version` string — SchemaVersion is the version of the RunConfig schema
  - `secrets` string[] — Secrets are the secret parameters to pass to the container Format: "<secret name>,target=<target environment variable>"
  - `target_host` string — TargetHost is the host to forward traffic to (only applicable to SSE transport)
  - `target_port` integer — TargetPort is the port for the container to expose (only applicable to SSE transport)
  - `telemetry_config` TelemetryConfig — DEPRECATED: Middleware configuration. TelemetryConfig contains the OpenTelemetry configuration
    - `customAttributes` object — CustomAttributes contains custom resource attributes to be added to all telemetry signals. These are parsed from CLI flags (--otel-custom-attributes) or environment variables (OTEL_RESOURCE_ATTRIBUTES) as key=value pairs. +optional
    - `enablePrometheusMetricsPath` boolean — EnablePrometheusMetricsPath controls whether to expose Prometheus-style /metrics endpoint. The metrics are served on the main transport port at /metrics. This is separate from OTLP metrics which are sent to the Endpoint. +kubebuilder:default=false +optional
    - `endpoint` string — Endpoint is the OTLP endpoint URL +optional
    - `environmentVariables` string[] — EnvironmentVariables is a list of environment variable names that should be included in telemetry spans as attributes. Only variables in this list will be read from the host machine and included in spans for observability. Example: ["NODE_ENV", "DEPLOYMENT_ENV", "SERVICE_VERSION"] +optional
    - `headers` object — Headers contains authentication headers for the OTLP endpoint. +optional
    - `insecure` boolean — Insecure indicates whether to use HTTP instead of HTTPS for the OTLP endpoint. +kubebuilder:default=false +optional
    - `metricsEnabled` boolean — MetricsEnabled controls whether OTLP metrics are enabled. When false, OTLP metrics are not sent even if an endpoint is configured. This is independent of EnablePrometheusMetricsPath. +kubebuilder:default=false +optional
    - `samplingRate` string — SamplingRate is the trace sampling rate (0.0-1.0) as a string. Only used when TracingEnabled is true. Example: "0.05" for 5% sampling. +kubebuilder:default="0.05" +optional
    - `serviceName` string — ServiceName is the service name for telemetry. When omitted, defaults to the server name (e.g., VirtualMCPServer name). +optional
    - `serviceVersion` string — ServiceVersion is the service version for telemetry. When omitted, defaults to the ToolHive version. +optional
    - `tracingEnabled` boolean — TracingEnabled controls whether distributed tracing is enabled. When false, no tracer provider is created even if an endpoint is configured. +kubebuilder:default=false +optional
  - `thv_ca_bundle` string — DEPRECATED: No longer appears to be used. ThvCABundle is the path to the CA certificate bundle for ToolHive HTTP operations
  - `token_exchange_config` TokenexchangeConfig — TokenExchangeConfig contains token exchange configuration for external authentication
    - `audience` string — Audience is the target audience for the exchanged token
    - `client_id` string — ClientID is the OAuth 2.0 client identifier
    - `client_secret` string — ClientSecret is the OAuth 2.0 client secret
    - `external_token_header_name` string — ExternalTokenHeaderName is the name of the custom header to use when HeaderStrategy is "custom"
    - `header_strategy` string — HeaderStrategy determines how to inject the token Valid values: HeaderStrategyReplace (default), HeaderStrategyCustom
    - `scopes` string[] — Scopes is the list of scopes to request for the exchanged token
    - `subject_token_type` string — SubjectTokenType specifies the type of the subject token being exchanged. Common values: tokenTypeAccessToken (default), tokenTypeIDToken, tokenTypeJWT. If empty, defaults to tokenTypeAccessToken.
    - `token_url` string — TokenURL is the OAuth 2.0 token endpoint URL
  - `tools_filter` string[] — DEPRECATED: Middleware configuration. ToolsFilter is the list of tools to filter
  - `tools_override` object — DEPRECATED: Middleware configuration. ToolsOverride is a map from an actual tool to its overridden name and/or description
  - `transport` 'stdio' | 'sse' | 'streamable-http' | 'inspector' — Transport is the transport mode (stdio, sse, or streamable-http)
  - `trust_proxy_headers` boolean — TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies
  - `volumes` string[] — Volumes are the directory mounts to pass to the container Format: "host-path:container-path[:ro]"

## Other responses

- `404` — Not Found

## Changes

- **2026-01-29** `ff6ce8dd8f3a` — 28 warning, 3 info
  - removed the optional property `additional_middleware_configs` from the response with the `200` status
  - removed the optional property `allow_docker_gateway` from the response with the `200` status
  - removed the optional property `allowed_origins` from the response with the `200` status
  - removed the optional property `audit_config/detectApplicationErrors` from the response with the `200` status
  - …27 more

[Change history](https://skmtc.dev/stacklok/apis/toolhive-api/changes/api/v1beta/workloads/:name/export/get.md)

---

[API](https://skmtc.dev/stacklok/apis/toolhive-api.md) · [All operations](https://skmtc.dev/stacklok/apis/toolhive-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stacklok/toolhive-api/revisions/ff6ce8dd8f3a/schema)