Gateways

Group tools and models behind Gateways, grant agent access, and configure scoped runtime endpoints

A Gateway is a named access surface that lists which tools and models an agent may reach and exposes one stable URL for that set. Dome checks membership and access grants before Rules run on each call.

Overview

A Gateway carries two related controls:

Resource membership makes a tool, pool, or model addressable through the Gateway's runtime endpoint.
Agent access admits the agent at the edge and generates rules that permit all current and future resource members.

Other workspace and custom rules still apply. Those rules can deny a resource member after the agent passes Gateway admission.

The typical workflow is:

Create a Gateway or reuse the Default gateway.
Add the resource as a member.
Grant the agent access to the Gateway.
Point the client at the Gateway's endpoint.
Verify reachability with that agent's API key.

Resource membership

Membership determines which resources a Gateway exposes:

Kind	What it exposes
Individual tool	One selected tool from a connection
Tool source	Every tool on an MCP connection, including tools discovered later
Pool	A pool behind its stable name
Direct model	One model connection by name

A resource with no Gateway membership stays valid. The resource shows as Unreachable because no runtime endpoint addresses it. Removing a membership leaves the underlying resource intact. Gateway membership is available in Rules through resource.gateways.contains("<id>"). Refer to the Rules reference.

You can change what a Gateway exposes when you add or remove members.

Agent access

A per-agent grant adds the Gateway to that agent's allowed resources (agents.register and rules.deploy). A workspace-wide grant covers every current and future agent in the workspace (rules.deploy and gateways.manage). gateways.manage alone cannot grant runtime access. Revoking a workspace-wide grant leaves per-agent grants in place.

Without either grant, invocation fails at edge admission (the completed operation has result=denied, denial.reason=permission_denied, and the Gateway-admission denial detail). Discovery such as tools/list and GET /v1/models is exempt from admission and stays membership- and Cedar-filtered. With a grant, other rules can still deny individual resource members. Generated permit rules are shown read-only in the dashboard.

You can change who reaches a Gateway when you grant or revoke access.

Default gateway

Every new workspace starts with an active Default Gateway that has no resource memberships or agent grants. Migrated workspaces may already have resources attached, but callers still need an explicit per-agent or all-agents grant.

The default marker only pre-selects a Gateway in dashboard dialogs that create tools, pools, and models. The marker adds no resources, grants no access, and overrides no rules.

Free and Pro workspaces support one Gateway, and the auto-created Default counts toward that limit. Team, Enterprise, and self-managed workspaces support additional Gateways. Exceeding the plan cap returns HTTP 429 / RESOURCE_EXHAUSTED.

You can move the marker when you set the Default gateway.

Runtime endpoints

Each Gateway has its own path under the workspace gateway host. Callers select a Gateway in the request URL. The base URL depends on the client protocol. A disabled Gateway rejects requests but keeps its memberships and grants.

Refer to Build the runtime endpoint for client-specific URL paths.

Cost quotas

A Gateway cost quota caps aggregate LLM spend for member pools and direct model connections. Exceeding the cap blocks further LLM calls through that Gateway until the active window resets. Filter audit by producer_gateway_id. Metrics dashboards do not break down by Gateway.

You can cap spend when you set a cost quota. Window and scope semantics are on the Quotas reference.

Interactive access

People can also reach a Gateway by signing in with their own Dome account, instead of you minting them an agent key. Enabling it creates one managed agent that every allow-listed person shares and rides individually, each audited under their own identity.

Enabling, eligibility, client setup, and token behavior are on Interactive MCP access.

Requirements

Before you begin:

Authenticate to Dome and select a workspace
Collect the resource and agent identifiers the operation needs
Have an active agent key with access to the selected Gateway when you verify runtime reachability

Permissions

Gateway membership, grants, and related operations require platform permissions. Each operation states its required permission inline.

Default roles	Permission	Grants
All workspace roles	`gateways.view`	List Gateways and inspect membership
`admin`, `operator`	`gateways.manage`	Create, update, and delete Gateways and membership
All workspace roles	`agents.view`	List agents when managing grants
`admin`, `operator`, `developer`	`agents.register`	Per-agent Gateway grants (with `rules.deploy`)
`admin`, `operator`, `security`	`rules.deploy`	Required for Gateway access-grant changes

Create Gateway

Create a separate Gateway when callers need a resource set or endpoint boundary that the Default gateway should not share. A new Gateway starts active with empty membership and no grants.

Requires gateways.manage.

dome gateways create prod-resources --description "Production tools and models"

Reference: dome gateways create

Tool: dome_gateways_create

{
  "name": "prod-resources",
  "description": "Production tools and models"
}

Reference: dome_gateways_create

POST /dome.gateway.v1.GatewayService/CreateGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "name": "prod-resources",
  "description": "Production tools and models"
}

Reference: CreateGateway

Create a Gateway

Create a Gateway named "prod-resources" for production tools and models.

Free and Pro workspaces support only one Gateway. Reuse, rename, or delete the Default gateway before creating another one.

After creation, retrieve the Gateway to confirm its ID, active state, empty membership, and grant settings.

Update Gateway

Update a Gateway to change its name or description.

Requires gateways.manage.

dome gateways update prod-resources --description "Production tools, pools, and models"

Omitted values remain unchanged.

Reference: dome gateways update

Tool: dome_gateways_update

{
  "name": "prod-resources",
  "new_name": "production-resources",
  "description": "Production tools, pools, and models"
}

Omitted values remain unchanged.

Reference: dome_gateways_update

An empty name keeps the current name. The API always writes description, so include the current description when it must remain unchanged.

POST /dome.gateway.v1.GatewayService/UpdateGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "name": "production-resources",
  "description": "Production tools, pools, and models"
}

Reference: UpdateGateway

Update a Gateway

Rename "prod-resources" to "production-resources" and update its description to "Production tools, pools, and models".

After the update, retrieve the Gateway to confirm its name and description.

Get Gateway

Retrieve one Gateway to inspect its state, default marker, workspace-wide grant, and resource memberships.

Requires gateways.view.

dome gateways get prod-resources

Reference: dome gateways get

Tool: dome_gateways_get

{
  "name": "prod-resources"
}

Reference: dome_gateways_get

POST /dome.gateway.v1.GatewayService/GetGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}"
}

Reference: GetGateway

Get a Gateway

Get "prod-resources" and show its state, grants, and resource memberships.

List Gateways

List Gateways to retrieve their names, IDs, states, default markers, and canonical endpoint paths.

Requires gateways.view.

dome gateways list

Reference: dome gateways list

Tool: dome_gateways_list

{}

Reference: dome_gateways_list

POST /dome.gateway.v1.GatewayService/ListGateways
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}"
}

Reference: ListGateways

List Gateways

List the Gateways in the active workspace with their IDs, states, and endpoint paths.

Set Default gateway

Set a Gateway as the workspace default to pre-select it in dashboard dialogs that create tools, pools, and models. Setting a new default clears the previous marker. A disabled default is not pre-selected.

Requires gateways.manage.

dome gateways set-default prod-resources

Reference: dome gateways set-default

Tool: dome_gateways_set_default

{
  "name": "prod-resources"
}

Reference: dome_gateways_set_default

POST /dome.gateway.v1.GatewayService/SetGatewayDefault
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}"
}

Reference: SetGatewayDefault

Set the default Gateway

Set "prod-resources" as the workspace's Default gateway.

After setting the default, retrieve the Gateway and confirm that it is marked as the workspace default.

Manage lifecycle

Manage a Gateway's availability without changing resource memberships or agent grants. Delete a Gateway only when callers no longer need that endpoint.

Enable Gateway

Enable a disabled Gateway to restore its endpoint. Disabling a Gateway preserves existing memberships and grants.

Requires gateways.manage.

dome gateways enable prod-resources

Reference: dome gateways enable

Tool: dome_gateways_set_state

{
  "name": "prod-resources",
  "state": "active"
}

Reference: dome_gateways_set_state

POST /dome.gateway.v1.GatewayService/SetGatewayState
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "state": "active"
}

Reference: SetGatewayState

Enable a Gateway

Enable the "prod-resources" Gateway.

Disable Gateway

Disable a Gateway to block its endpoint without removing memberships or grants. Requests stay rejected until you enable the Gateway again.

Requires gateways.manage.

dome gateways disable prod-resources

Reference: dome gateways disable

Tool: dome_gateways_set_state

{
  "name": "prod-resources",
  "state": "disabled"
}

Reference: dome_gateways_set_state

POST /dome.gateway.v1.GatewayService/SetGatewayState
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "state": "disabled"
}

Reference: SetGatewayState

Disable a Gateway

Disable "prod-resources" while preserving its memberships and grants.

After enabling or disabling a Gateway, retrieve the Gateway to confirm the resulting state.

Delete Gateway

Delete a Gateway only after moving callers to another endpoint. Deletion removes the Gateway and its resource memberships. The /gateways/{{GATEWAY_ID}}/... endpoint starts rejecting requests. Deletion does not remove the underlying tools, connections, pools, or models.

Requires gateways.manage.

Deletion is permanent. Per-agent grants for the deleted ID no longer admit callers. Callers must use another Gateway ID.

dome gateways delete prod-resources

Reference: dome gateways delete

Tool: dome_gateways_delete

{
  "name": "prod-resources"
}

Reference: dome_gateways_delete

POST /dome.gateway.v1.GatewayService/DeleteGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}"
}

Reference: DeleteGateway

Delete a Gateway

Delete "prod-resources" without deleting its underlying resources.

After deletion, list the Gateways to confirm the deleted Gateway no longer appears.

Manage resource memberships

Add or remove members so resources are addressable through a Gateway. Membership kinds are in Overview. Membership changes do not modify or delete the underlying resources.

Individual tools

Add or remove one tool without exposing the rest of its connection.

Add individual tool

Add one tool without exposing the other tools from its connection.

Requires gateways.manage.

dome gateways tools add prod-resources {{TOOL_ID}}

Reference: dome gateways tools add

Tool: dome_gateways_tool_add

{
  "gateway": "prod-resources",
  "connection": "notion",
  "tool": "create_page"
}

Reference: dome_gateways_tool_add

POST /dome.gateway.v1.GatewayService/AddGatewayTool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "tool_id": "{{TOOL_ID}}"
}

Reference: AddGatewayTool

Add an individual tool

Add the "create_page" tool from the "notion" connection to "prod-resources".

Remove individual tool

Remove an individual membership to stop exposing the tool on its own. The tool stays addressable when a tool-source membership also covers that tool.

Requires gateways.manage.

dome gateways tools remove prod-resources {{TOOL_ID}}

Reference: dome gateways tools remove

Tool: dome_gateways_tool_remove

{
  "gateway": "prod-resources",
  "connection": "notion",
  "tool": "create_page"
}

Reference: dome_gateways_tool_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayTool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "tool_id": "{{TOOL_ID}}"
}

Reference: RemoveGatewayTool

Remove an individual tool

Remove the "create_page" tool from "prod-resources" without deleting the tool.

Tool source

Add or remove an entire MCP connection. Newly discovered tools on that connection join the Gateway automatically.

Add tool source

Add a tool source to include every tool currently on that connection.

Requires gateways.manage.

dome gateways tool-sources add prod-resources notion

Reference: dome gateways tool-sources add

Tool: dome_gateways_tool_source_add

{
  "gateway": "prod-resources",
  "connection": "notion"
}

Reference: dome_gateways_tool_source_add

POST /dome.gateway.v1.GatewayService/AddGatewayToolSource
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "connection_id": "{{CONNECTION_ID}}"
}

Reference: AddGatewayToolSource

Add a tool source

Add the entire "notion" tool source to "prod-resources", including newly discovered tools.

Remove tool source

Remove a tool-source membership to stop automatically including tools from that connection. Individually added tools remain in the Gateway.

Requires gateways.manage.

dome gateways tool-sources remove prod-resources notion

Reference: dome gateways tool-sources remove

Tool: dome_gateways_tool_source_remove

{
  "gateway": "prod-resources",
  "connection": "notion"
}

Reference: dome_gateways_tool_source_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayToolSource
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "connection_id": "{{CONNECTION_ID}}"
}

Reference: RemoveGatewayToolSource

Remove a tool source

Remove the "notion" tool source from "prod-resources" without deleting the connection.

Pool

Add or remove a pool so agents can call it by its stable name through the Gateway. Changes to the pool's members do not require a membership update.

Add pool

Add a pool to expose its routed models through the Gateway.

Requires gateways.manage.

dome gateways model-pools add prod-resources production

Reference: dome gateways model-pools add

Tool: dome_gateways_model_pool_add

{
  "gateway": "prod-resources",
  "pool": "production"
}

Reference: dome_gateways_model_pool_add

POST /dome.gateway.v1.GatewayService/AddGatewayLLMPool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_pool_id": "{{POOL_ID}}"
}

Reference: AddGatewayLLMPool

Add a model pool

Add the "production" model pool to "prod-resources".

Remove pool

Remove a pool to stop exposing that pool through the Gateway. The pool and its members remain configured.

Requires gateways.manage.

dome gateways model-pools remove prod-resources production

Reference: dome gateways model-pools remove

Tool: dome_gateways_model_pool_remove

{
  "gateway": "prod-resources",
  "pool": "production"
}

Reference: dome_gateways_model_pool_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayLLMPool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_pool_id": "{{POOL_ID}}"
}

Reference: RemoveGatewayLLMPool

Remove a model pool

Remove the "production" model pool from "prod-resources" without deleting the pool.

Direct model

Add or remove one model connection without routing through a pool.

Add direct model

Add a direct model connection to make that model name addressable through the Gateway.

Requires gateways.manage.

dome gateways models add prod-resources claude-prod

Reference: dome gateways models add

Tool: dome_gateways_model_add

{
  "gateway": "prod-resources",
  "model": "claude-prod"
}

Reference: dome_gateways_model_add

POST /dome.gateway.v1.GatewayService/AddGatewayLLMModel
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_model_connection_id": "{{MODEL_CONNECTION_ID}}"
}

Reference: AddGatewayLLMModel

Add a direct model

Add "claude-prod" directly to "prod-resources".

Remove direct model

Remove a direct model connection to stop exposing it through the Gateway without deleting the connection.

Requires gateways.manage.

dome gateways models remove prod-resources claude-prod

Reference: dome gateways models remove

Tool: dome_gateways_model_remove

{
  "gateway": "prod-resources",
  "model": "claude-prod"
}

Reference: dome_gateways_model_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayLLMModel
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_model_connection_id": "{{MODEL_CONNECTION_ID}}"
}

Reference: RemoveGatewayLLMModel

Remove a direct model

Remove "claude-prod" from "prod-resources" without deleting the model connection.

After any membership change, retrieve the Gateway to confirm its individual tool, tool source, model pool, and direct model memberships.

Manage agent access

Grant or revoke who is admitted at the Gateway edge. Per-agent and workspace-wide grants are in Overview. Other Rules can still deny individual members after admission.

List agent access

List agents and show whether each agent has a per-agent grant to the Gateway. Revoked agents are excluded. Suspended agents remain listed so you can inspect their grants before reactivation.

Requires agents.view.

dome gateways access list prod-resources

Reference: dome gateways access list

Tool: dome_gateways_access_list

{
  "gateway": "prod-resources"
}

Reference: dome_gateways_access_list

The API returns every agent in the workspace. Exclude revoked agents, then check whether each remaining agent's allowed_gateway_ids contains the target Gateway ID.

GET /v1/agents?workspace_id={{WORKSPACE_ID}}

Reference: ListAgents

List agent access

List agents and show whether each one has a per-agent grant to "prod-resources".

Grant one agent

Grant one agent access while preserving its existing Gateway grants. Dome generates and manages the permit rules. You cannot edit those rules directly.

Requires agents.register and rules.deploy.

dome gateways access grant prod-resources data-pipeline-agent

Reference: dome gateways access grant

Tool: dome_gateways_agent_grant

{
  "gateway": "prod-resources",
  "agent_id": "{{AGENT_ID}}"
}

Reference: dome_gateways_agent_grant

The allowed_gateway_ids field replaces the agent's full list. Include every existing Gateway ID that the agent should keep, plus the new ID.

PATCH /v1/agents/{{AGENT_ID}}
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "allowed_gateway_ids": [
    "{{EXISTING_GATEWAY_ID}}",
    "{{GATEWAY_ID}}"
  ],
  "update_mask": "allowed_gateway_ids"
}

Reference: UpdateAgent

Grant one agent

Grant "data-pipeline-agent" access to "prod-resources" and preserve its existing Gateway grants.

Revoke one agent

Revoke one agent's access to the Gateway while preserving its other Gateway grants. Requests from that agent to the Gateway endpoint fail at edge admission unless a workspace-wide grant also applies.

Requires agents.register and rules.deploy.

dome gateways access revoke prod-resources data-pipeline-agent

Reference: dome gateways access revoke

Tool: dome_gateways_agent_revoke

{
  "gateway": "prod-resources",
  "agent_id": "{{AGENT_ID}}"
}

Reference: dome_gateways_agent_revoke

The allowed_gateway_ids field replaces the agent's full list. Omit the revoked ID and preserve every other ID the agent should keep.

PATCH /v1/agents/{{AGENT_ID}}
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "allowed_gateway_ids": [
    "{{OTHER_GATEWAY_ID}}"
  ],
  "update_mask": "allowed_gateway_ids"
}

Reference: UpdateAgent

Revoke one agent

Revoke "data-pipeline-agent" access to "prod-resources" and preserve its other Gateway grants.

Grant every workspace agent

Grant every current and future workspace agent access when all agents need the same endpoint. Other rules can still deny individual resources after admission.

Requires gateways.manage and rules.deploy.

dome gateways access grant-all prod-resources

Reference: dome gateways access grant-all

Tool: dome_gateways_all_agents_grant

{
  "gateway": "prod-resources"
}

Reference: dome_gateways_all_agents_grant

POST /dome.gateway.v1.GatewayService/SetGatewayAllAgentsGrant
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "granted": true
}

Reference: SetGatewayAllAgentsGrant

Grant every workspace agent

Grant every current and future workspace agent access to "prod-resources".

Revoke every workspace agent

Revoke the workspace-wide grant to stop automatically admitting every agent. Existing per-agent grants remain in place.

Requires gateways.manage and rules.deploy.

dome gateways access revoke-all prod-resources

Reference: dome gateways access revoke-all

Tool: dome_gateways_all_agents_revoke

{
  "gateway": "prod-resources"
}

Reference: dome_gateways_all_agents_revoke

POST /dome.gateway.v1.GatewayService/SetGatewayAllAgentsGrant
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "granted": false
}

Reference: SetGatewayAllAgentsGrant

Revoke every workspace agent

Revoke the workspace-wide grant from "prod-resources" without changing per-agent grants.

After any access change, list agent access to confirm the resulting per-agent grants. For a workspace-wide grant, retrieve the Gateway and check its workspace-wide grant setting.

Manage cost quotas

Cap aggregate LLM spend for member pools and direct model connections on this Gateway. Refer to Overview. Window and scope semantics are on the Quotas reference.

List cost quotas

List Gateway cost quotas in the workspace or filter the result to one Gateway.

Requires gateways.view.

dome quotas list --gateway prod-resources

Reference: dome quotas list

Tool: dome_quotas_list

{
  "gateway": "prod-resources"
}

Reference: dome_quotas_list

The API returns every LLM quota in the workspace. Filter the response to records with subject_type equal to gateway and the desired subject_id.

GET /v1/quotas?workspace_id={{WORKSPACE_ID}}

Reference: ListLLMQuotas

List cost quotas

List the cost quotas for the "prod-resources" Gateway.

Set a cost quota

Set a daily or monthly USD spend cap for LLM calls through a Gateway. Once spend exceeds the cap, LLM calls addressed to that Gateway return HTTP 429.

Requires gateways.manage.

dome quotas set --subject gateway --gateway prod-resources --limit 500 --window monthly --name "prod-monthly"

Reference: dome quotas set

Tool: dome_quotas_set

{
  "subject": "gateway",
  "gateway": "prod-resources",
  "limit_usd": 500,
  "window": "monthly",
  "name": "prod-monthly"
}

Reference: dome_quotas_set

The API expresses the limit in millionths of a US dollar. For example, $500 is 500000000.

POST /v1/quotas
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "subject_type": "gateway",
  "subject_id": "{{GATEWAY_ID}}",
  "limit_micros": "500000000",
  "window": "monthly",
  "name": "prod-monthly",
  "enabled": true
}

Reference: CreateLLMQuota

Set a cost quota

Create a monthly $500 cost quota named "prod-monthly" for "prod-resources".

Remove a cost quota

Remove a Gateway cost quota to stop enforcing that cap.

Requires gateways.manage.

Removing a quota takes away an active spending control. Confirm the quota ID with the list operation first.

dome quotas rm {{QUOTA_ID}}

Reference: dome quotas rm

Tool: dome_quotas_remove

{
  "quota_id": "{{QUOTA_ID}}"
}

Reference: dome_quotas_remove

Confirm that the quota has subject_type: gateway before deleting it. The generic API endpoint does not add the CLI and MCP subject-type guard.

DELETE /v1/quotas/{{QUOTA_ID}}?workspace_id={{WORKSPACE_ID}}

Reference: DeleteLLMQuota

Remove a cost quota

Confirm that "{{QUOTA_ID}}" is a Gateway quota, then remove it.

After any quota change, list cost quotas to confirm the active caps and reset windows.

Build the runtime endpoint

Build the runtime endpoint from the workspace gateway host and the Gateway ID. Retrieve the ID with List Gateways.

Requires gateways.view to retrieve the ID. Runtime calls require an active agent key and a grant to the Gateway.

Use the ID in the canonical prefix:

https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}

Choose the base URL that matches the client.

Client	Base URL	Client appends
Dome SDK	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}`	nothing, used as-is
Anthropic SDK	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}`	`/v1/messages` (SDK-managed)
OpenAI-compatible SDK	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/v1`	`/chat/completions`, `/embeddings`, …
MCP client	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/mcp`	protocol frames

Do not add /v1 to the Anthropic base URL because the Anthropic SDK appends /v1/messages. Bare /mcp and /v1 requests return HTTP 400. Every caller must select a Gateway in the URL.

The /mcp endpoint speaks Streamable HTTP only, not the legacy standalone SSE transport. Configure MCP clients for http (or streamable-http), not sse.

Run dome gateways get <name-or-id> --json to retrieve the complete gateway_url, mcp_url, openai_base_url, and anthropic_base_url. SDK agent-key creation and token exchange return the same authoritative endpoint set. Refer to Python SDK Gateways.

Verify reachability

Verify discovery before invoking a tool or model. Discovery returns only members of the selected Gateway that the agent's grant and applicable rules permit.

Requires an active agent key, access to the Gateway, and rules that allow discovery.

List MCP tools through the scoped endpoint:

curl -X POST "https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/mcp" \
  -H "Authorization: Bearer {{DOME_AGENT_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

List model pools and direct model connections through the OpenAI-compatible endpoint:

curl "https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/v1/models" \
  -H "Authorization: Bearer {{DOME_AGENT_KEY}}"

Configure runtime credentials and SDK clients in Develop.

Troubleshoot reachability

Use the observed response to locate the failed layer.

Symptom	Likely cause	Resolution
HTTP `400` asks for a Gateway	The client used bare `/mcp` or `/v1`	Add `/gateways/{{GATEWAY_ID}}` before the protocol path
Gateway is unavailable	The ID is unknown, disabled, or not yet synchronized	Verify the ID, enable the Gateway, and wait for gateway synchronization to complete
Invocation is denied before rules evaluate	The agent lacks access to the Gateway	Add a per-agent or workspace-wide grant
Discovery returns no resources	The agent lacks access, the Gateway has no matching members, or rules deny discovery	Check agent access, membership, and rules
Tool is missing from `tools/list`	The tool lacks membership, is blocked, or rules deny discovery	Check individual and tool-source membership, tool status, and rules
Pool or model is missing from `/v1/models`	The resource lacks membership or rules deny discovery	Check pool or direct-model membership and model rules
Resource shows Unreachable	The resource belongs to no Gateway	Add the resource or its containing tool source or pool
LLM call returns HTTP `429`	A Gateway or other LLM cost quota is exhausted	List active quotas and check their reset windows
Gateway creation is rejected at the plan limit	The workspace already has the maximum number of Gateways	Reuse, rename, or delete the Default gateway, or change plans
Anthropic request returns HTTP `404`	The client base URL includes an extra `/v1`	Use `https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}`

After changing memberships or grants, wait for gateway synchronization before testing again. If discovery succeeds but invocation fails, inspect the resource rules and the agent's lifecycle state.

Next steps

Gateways concept for how membership and grants work
Interactive MCP access to let people sign in with their own account instead of an agent key
Register agents to create agent identities and keys
Tools to configure tool connections and catalog state
Pools to configure pools and routing

Gateways

On this page