Gateways - Dome

Overview

A Gateway carries two related controls:

Resource membership makes a tool, pool, or model addressable through the Gateway’s runtime endpoint.
Agent access admits the agent at the edge and generates rules that permit all current and future resource members.

Other workspace and custom rules still apply. Those rules can deny a resource member after the agent passes Gateway admission. The typical workflow is:

Create a Gateway or reuse the Default gateway.
Add the resource as a member.
Grant the agent access to the Gateway.
Point the client at the Gateway’s endpoint.
Verify reachability with that agent’s API key.

Resource membership

Membership determines which resources a Gateway exposes:

Kind	What it exposes
Individual tool	One selected tool from a connection
Tool source	Every tool on an MCP connection, including tools discovered later
Pool	A pool behind its stable name
Direct model	One model connection by name

A resource with no Gateway membership stays valid. The resource shows as Unreachable because no runtime endpoint addresses it. Removing a membership leaves the underlying resource intact. Gateway membership is available in Rules through resource.gateways.contains("<id>"). Refer to the Rules reference. You can change what a Gateway exposes when you add or remove members.

Agent access

A per-agent grant adds the Gateway to that agent’s allowed resources (agent.register and rules.deploy). A workspace-wide grant covers every current and future agent in the workspace (rules.deploy and gateway.manage). gateway.manage alone cannot grant runtime access. Revoking a workspace-wide grant leaves per-agent grants in place. Without either grant, invocation fails at edge admission (access.denied / permission_denied with DENY_DETAIL_CODE_GATEWAY_ADMISSION). Discovery such as tools/list and GET /v1/models is exempt from admission and stays membership- and Cedar-filtered. With a grant, other rules can still deny individual resource members. Generated permit rules are shown read-only in the dashboard. You can change who reaches a Gateway when you grant or revoke access.

Default gateway

Every new workspace starts with an active Default Gateway that has no resource memberships or agent grants. Migrated workspaces may already have resources attached, but callers still need an explicit per-agent or all-agents grant. The default marker only pre-selects a Gateway in dashboard dialogs that create tools, pools, and models. The marker adds no resources, grants no access, and overrides no rules. Free and Pro workspaces support one Gateway, and the auto-created Default counts toward that limit. Team, Enterprise, and self-managed workspaces support additional Gateways. Exceeding the plan cap returns HTTP 429 / RESOURCE_EXHAUSTED. You can move the marker when you set the Default gateway.

Runtime endpoints

Each Gateway has its own path under the workspace gateway host. Callers select a Gateway in the request URL. The base URL depends on the client protocol. A disabled Gateway rejects requests but keeps its memberships and grants. Refer to Build the runtime endpoint for client-specific URL paths.

Cost quotas

A Gateway cost quota caps aggregate LLM spend for member pools and direct model connections. Exceeding the cap blocks further LLM calls through that Gateway until the active window resets. Filter audit by producer_gateway_id. Metrics dashboards do not break down by Gateway. You can cap spend when you set a cost quota. Window and scope semantics are on the Quotas reference.

Requirements

Before you begin:

Authenticate to Dome and select a workspace
Collect the resource and agent identifiers the operation needs
Have an active agent key with access to the selected Gateway when you verify runtime reachability

Permissions

Gateway membership, grants, and related operations require platform permissions. Each operation states its required permission inline.

Default roles	Permission	Grants
All workspace roles	`gateway.view`	List Gateways and inspect membership
`admin`, `operator`	`gateway.manage`	Create, update, and delete Gateways and membership
All workspace roles	`agent.view`	List agents when managing grants
`admin`, `operator`, `developer`	`agent.register`	Per-agent Gateway grants (with `rules.deploy`)
`admin`, `operator`, `security`	`rules.deploy`	Required for Gateway access-grant changes

Create Gateway

Create a separate Gateway when callers need a resource set or endpoint boundary that the Default gateway should not share. A new Gateway starts active with empty membership and no grants.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway create prod-resources --description "Production tools and models"

Reference: dome gateway create

Tool: dome_gateway_create

{
  "name": "prod-resources",
  "description": "Production tools and models"
}

Reference: dome_gateway_create

POST /dome.gateway.v1.GatewayService/CreateGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "name": "prod-resources",
  "description": "Production tools and models"
}

Reference: CreateGateway

Create a Gateway

Create a Gateway named "prod-resources" for production tools and models.

Free and Pro workspaces support only one Gateway. Reuse, rename, or delete the Default gateway before creating another one.

After creation, retrieve the Gateway to confirm its ID, active state, empty membership, and grant settings.

Update Gateway

Update a Gateway to change its name or description.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway update prod-resources --description "Production tools, pools, and models"

Omitted values remain unchanged.

Reference: dome gateway update

Tool: dome_gateway_update

{
  "name": "prod-resources",
  "new_name": "production-resources",
  "description": "Production tools, pools, and models"
}

Omitted values remain unchanged.

Reference: dome_gateway_update

An empty name keeps the current name. The API always writes description, so include the current description when it must remain unchanged.

POST /dome.gateway.v1.GatewayService/UpdateGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "name": "production-resources",
  "description": "Production tools, pools, and models"
}

Reference: UpdateGateway

Update a Gateway

Rename "prod-resources" to "production-resources" and update its description to "Production tools, pools, and models".

After the update, retrieve the Gateway to confirm its name and description.

Get Gateway

Retrieve one Gateway to inspect its state, default marker, workspace-wide grant, and resource memberships.

Requires gateway.view.

CLI
MCP
API
Agent

dome gateway get prod-resources

Reference: dome gateway get

Tool: dome_gateway_get

{
  "name": "prod-resources"
}

Reference: dome_gateway_get

POST /dome.gateway.v1.GatewayService/GetGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}"
}

Reference: GetGateway

Get a Gateway

Get "prod-resources" and show its state, grants, and resource memberships.

List Gateways

List Gateways to retrieve their names, IDs, states, default markers, and canonical endpoint paths.

Requires gateway.view.

CLI
MCP
API
Agent

dome gateway list

Reference: dome gateway list

Tool: dome_gateway_list

{}

Reference: dome_gateway_list

POST /dome.gateway.v1.GatewayService/ListGateways
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}"
}

Reference: ListGateways

List Gateways

List the Gateways in the active workspace with their IDs, states, and endpoint paths.

Set Default gateway

Set a Gateway as the workspace default to pre-select it in dashboard dialogs that create tools, pools, and models. Setting a new default clears the previous marker. A disabled default is not pre-selected.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway set-default prod-resources

Reference: dome gateway set-default

Tool: dome_gateway_set_default

{
  "name": "prod-resources"
}

Reference: dome_gateway_set_default

POST /dome.gateway.v1.GatewayService/SetGatewayDefault
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}"
}

Reference: SetGatewayDefault

Set the default Gateway

Set "prod-resources" as the workspace's Default gateway.

After setting the default, retrieve the Gateway and confirm that it is marked as the workspace default.

Manage lifecycle

Manage a Gateway’s availability without changing resource memberships or agent grants. Delete a Gateway only when callers no longer need that endpoint.

Enable Gateway

Enable a disabled Gateway to restore its endpoint. Disabling a Gateway preserves existing memberships and grants.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway enable prod-resources

Reference: dome gateway enable

Tool: dome_gateway_set_state

{
  "name": "prod-resources",
  "state": "active"
}

Reference: dome_gateway_set_state

POST /dome.gateway.v1.GatewayService/SetGatewayState
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "state": "active"
}

Reference: SetGatewayState

Enable a Gateway

Enable the "prod-resources" Gateway.

Disable Gateway

Disable a Gateway to block its endpoint without removing memberships or grants. Requests stay rejected until you enable the Gateway again.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway disable prod-resources

Reference: dome gateway disable

Tool: dome_gateway_set_state

{
  "name": "prod-resources",
  "state": "disabled"
}

Reference: dome_gateway_set_state

POST /dome.gateway.v1.GatewayService/SetGatewayState
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "state": "disabled"
}

Reference: SetGatewayState

Disable a Gateway

Disable "prod-resources" while preserving its memberships and grants.

After enabling or disabling a Gateway, retrieve the Gateway to confirm the resulting state.

Delete Gateway

Delete a Gateway only after moving callers to another endpoint. Deletion removes the Gateway and its resource memberships. The /gateways/{{GATEWAY_ID}}/... endpoint starts rejecting requests. Deletion does not remove the underlying tools, connections, pools, or models.

Requires gateway.manage.

Deletion is permanent. Per-agent grants for the deleted ID no longer admit callers. Callers must use another Gateway ID.

CLI
MCP
API
Agent

dome gateway delete prod-resources

Reference: dome gateway delete

Tool: dome_gateway_delete

{
  "name": "prod-resources"
}

Reference: dome_gateway_delete

POST /dome.gateway.v1.GatewayService/DeleteGateway
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}"
}

Reference: DeleteGateway

Delete a Gateway

Delete "prod-resources" without deleting its underlying resources.

After deletion, list the Gateways to confirm the deleted Gateway no longer appears.

Manage resource memberships

Add or remove members so resources are addressable through a Gateway. Membership kinds are in Overview. Membership changes do not modify or delete the underlying resources.

Individual tools

Add or remove one tool without exposing the rest of its connection.

Add individual tool

Add one tool without exposing the other tools from its connection.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway tools add prod-resources {{TOOL_ID}}

Reference: dome gateway tools add

Tool: dome_gateway_tool_add

{
  "gateway": "prod-resources",
  "connection": "notion",
  "tool": "create_page"
}

Reference: dome_gateway_tool_add

POST /dome.gateway.v1.GatewayService/AddGatewayTool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "tool_id": "{{TOOL_ID}}"
}

Reference: AddGatewayTool

Add an individual tool

Add the "create_page" tool from the "notion" connection to "prod-resources".

Remove individual tool

Remove an individual membership to stop exposing the tool on its own. The tool stays addressable when a tool-source membership also covers that tool.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway tools remove prod-resources {{TOOL_ID}}

Reference: dome gateway tools remove

Tool: dome_gateway_tool_remove

{
  "gateway": "prod-resources",
  "connection": "notion",
  "tool": "create_page"
}

Reference: dome_gateway_tool_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayTool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "tool_id": "{{TOOL_ID}}"
}

Reference: RemoveGatewayTool

Remove an individual tool

Remove the "create_page" tool from "prod-resources" without deleting the tool.

Tool source

Add or remove an entire MCP connection. Newly discovered tools on that connection join the Gateway automatically.

Add tool source

Add a tool source to include every tool currently on that connection.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway tool-sources add prod-resources notion

Reference: dome gateway tool-sources add

Tool: dome_gateway_tool_source_add

{
  "gateway": "prod-resources",
  "connection": "notion"
}

Reference: dome_gateway_tool_source_add

POST /dome.gateway.v1.GatewayService/AddGatewayToolSource
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "connection_id": "{{CONNECTION_ID}}"
}

Reference: AddGatewayToolSource

Add a tool source

Add the entire "notion" tool source to "prod-resources", including newly discovered tools.

Remove tool source

Remove a tool-source membership to stop automatically including tools from that connection. Individually added tools remain in the Gateway.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway tool-sources remove prod-resources notion

Reference: dome gateway tool-sources remove

Tool: dome_gateway_tool_source_remove

{
  "gateway": "prod-resources",
  "connection": "notion"
}

Reference: dome_gateway_tool_source_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayToolSource
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "connection_id": "{{CONNECTION_ID}}"
}

Reference: RemoveGatewayToolSource

Remove a tool source

Remove the "notion" tool source from "prod-resources" without deleting the connection.

Pool

Add or remove a pool so agents can call it by its stable name through the Gateway. Changes to the pool’s members do not require a membership update.

Add pool

Add a pool to expose its routed models through the Gateway.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway model-pools add prod-resources production

Reference: dome gateway model-pools add

Tool: dome_gateway_model_pool_add

{
  "gateway": "prod-resources",
  "pool": "production"
}

Reference: dome_gateway_model_pool_add

POST /dome.gateway.v1.GatewayService/AddGatewayLLMPool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_pool_id": "{{POOL_ID}}"
}

Reference: AddGatewayLLMPool

Add a model pool

Add the "production" model pool to "prod-resources".

Remove pool

Remove a pool to stop exposing that pool through the Gateway. The pool and its members remain configured.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway model-pools remove prod-resources production

Reference: dome gateway model-pools remove

Tool: dome_gateway_model_pool_remove

{
  "gateway": "prod-resources",
  "pool": "production"
}

Reference: dome_gateway_model_pool_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayLLMPool
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_pool_id": "{{POOL_ID}}"
}

Reference: RemoveGatewayLLMPool

Remove a model pool

Remove the "production" model pool from "prod-resources" without deleting the pool.

Direct model

Add or remove one model connection without routing through a pool.

Add direct model

Add a direct model connection to make that model name addressable through the Gateway.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway models add prod-resources claude-prod

Reference: dome gateway models add

Tool: dome_gateway_model_add

{
  "gateway": "prod-resources",
  "model": "claude-prod"
}

Reference: dome_gateway_model_add

POST /dome.gateway.v1.GatewayService/AddGatewayLLMModel
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_model_connection_id": "{{MODEL_CONNECTION_ID}}"
}

Reference: AddGatewayLLMModel

Add a direct model

Add "claude-prod" directly to "prod-resources".

Remove direct model

Remove a direct model connection to stop exposing it through the Gateway without deleting the connection.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway models remove prod-resources claude-prod

Reference: dome gateway models remove

Tool: dome_gateway_model_remove

{
  "gateway": "prod-resources",
  "model": "claude-prod"
}

Reference: dome_gateway_model_remove

POST /dome.gateway.v1.GatewayService/RemoveGatewayLLMModel
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "llm_model_connection_id": "{{MODEL_CONNECTION_ID}}"
}

Reference: RemoveGatewayLLMModel

Remove a direct model

Remove "claude-prod" from "prod-resources" without deleting the model connection.

After any membership change, retrieve the Gateway to confirm its individual tool, tool source, model pool, and direct model memberships.

Manage agent access

Grant or revoke who is admitted at the Gateway edge. Per-agent and workspace-wide grants are in Overview. Other Rules can still deny individual members after admission.

List agent access

List agents and show whether each agent has a per-agent grant to the Gateway. Revoked agents are excluded. Suspended agents remain listed so you can inspect their grants before reactivation.

Requires agent.view.

CLI
MCP
API
Agent

dome gateway access list prod-resources

Reference: dome gateway access list

Tool: dome_gateway_access_list

{
  "gateway": "prod-resources"
}

Reference: dome_gateway_access_list

The API returns every agent in the workspace. Exclude revoked agents, then check whether each remaining agent’s allowed_gateway_ids contains the target Gateway ID.

POST /dome.agent.v1.AgentRegistry/ListAgents
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}"
}

Reference: ListAgents

List agent access

List agents and show whether each one has a per-agent grant to "prod-resources".

Grant one agent

Grant one agent access while preserving its existing Gateway grants. Dome generates and manages the permit rules. You cannot edit those rules directly.

Requires agent.register and rules.deploy.

CLI
MCP
API
Agent

dome gateway access grant prod-resources data-pipeline-agent

Reference: dome gateway access grant

Tool: dome_gateway_agent_grant

{
  "gateway": "prod-resources",
  "agent_id": "{{AGENT_ID}}"
}

Reference: dome_gateway_agent_grant

The allowed_gateway_ids field replaces the agent’s full list. Include every existing Gateway ID that the agent should keep, plus the new ID.

POST /dome.agent.v1.AgentRegistry/UpdateAgent
Content-Type: application/json

{
  "agent_id": "{{AGENT_ID}}",
  "workspace_id": "{{WORKSPACE_ID}}",
  "allowed_gateway_ids": [
    "{{EXISTING_GATEWAY_ID}}",
    "{{GATEWAY_ID}}"
  ],
  "update_mask": "allowed_gateway_ids"
}

Reference: UpdateAgent

Grant one agent

Grant "data-pipeline-agent" access to "prod-resources" and preserve its existing Gateway grants.

Revoke one agent

Revoke one agent’s access to the Gateway while preserving its other Gateway grants. Requests from that agent to the Gateway endpoint fail at edge admission unless a workspace-wide grant also applies.

Requires agent.register and rules.deploy.

CLI
MCP
API
Agent

dome gateway access revoke prod-resources data-pipeline-agent

Reference: dome gateway access revoke

Tool: dome_gateway_agent_revoke

{
  "gateway": "prod-resources",
  "agent_id": "{{AGENT_ID}}"
}

Reference: dome_gateway_agent_revoke

The allowed_gateway_ids field replaces the agent’s full list. Omit the revoked ID and preserve every other ID the agent should keep.

POST /dome.agent.v1.AgentRegistry/UpdateAgent
Content-Type: application/json

{
  "agent_id": "{{AGENT_ID}}",
  "workspace_id": "{{WORKSPACE_ID}}",
  "allowed_gateway_ids": [
    "{{OTHER_GATEWAY_ID}}"
  ],
  "update_mask": "allowed_gateway_ids"
}

Reference: UpdateAgent

Revoke one agent

Revoke "data-pipeline-agent" access to "prod-resources" and preserve its other Gateway grants.

Grant every workspace agent

Grant every current and future workspace agent access when all agents need the same endpoint. Other rules can still deny individual resources after admission.

Requires gateway.manage and rules.deploy.

CLI
MCP
API
Agent

dome gateway access grant-all prod-resources

Reference: dome gateway access grant-all

Tool: dome_gateway_all_agents_grant

{
  "gateway": "prod-resources"
}

Reference: dome_gateway_all_agents_grant

POST /dome.gateway.v1.GatewayService/SetGatewayAllAgentsGrant
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "granted": true
}

Reference: SetGatewayAllAgentsGrant

Grant every workspace agent

Grant every current and future workspace agent access to "prod-resources".

Revoke every workspace agent

Revoke the workspace-wide grant to stop automatically admitting every agent. Existing per-agent grants remain in place.

Requires gateway.manage and rules.deploy.

CLI
MCP
API
Agent

dome gateway access revoke-all prod-resources

Reference: dome gateway access revoke-all

Tool: dome_gateway_all_agents_revoke

{
  "gateway": "prod-resources"
}

Reference: dome_gateway_all_agents_revoke

POST /dome.gateway.v1.GatewayService/SetGatewayAllAgentsGrant
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "gateway_id": "{{GATEWAY_ID}}",
  "granted": false
}

Reference: SetGatewayAllAgentsGrant

Revoke every workspace agent

Revoke the workspace-wide grant from "prod-resources" without changing per-agent grants.

After any access change, list agent access to confirm the resulting per-agent grants. For a workspace-wide grant, retrieve the Gateway and check its workspace-wide grant setting.

Manage cost quotas

Cap aggregate LLM spend for member pools and direct model connections on this Gateway. Refer to Overview. Window and scope semantics are on the Quotas reference.

List cost quotas

List Gateway cost quotas in the workspace or filter the result to one Gateway.

Requires gateway.view.

CLI
MCP
API
Agent

dome gateway quota list prod-resources

Reference: dome gateway quota list

Tool: dome_gateway_quota_list

{
  "gateway": "prod-resources"
}

Reference: dome_gateway_quota_list

The API returns every LLM quota in the workspace. Filter the response to records with subject_type equal to gateway and the desired subject_id.

POST /dome.mgmt.v1.Management/ListLLMQuotas
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}"
}

Reference: ListLLMQuotas

List cost quotas

List the cost quotas for the "prod-resources" Gateway.

Set a cost quota

Set a daily or monthly USD spend cap for LLM calls through a Gateway. Once spend exceeds the cap, LLM calls addressed to that Gateway return HTTP 429.

Requires gateway.manage.

CLI
MCP
API
Agent

dome gateway quota set prod-resources --limit 500 --window monthly --name "prod-monthly"

Reference: dome gateway quota set

Tool: dome_gateway_quota_set

{
  "gateway": "prod-resources",
  "limit_usd": 500,
  "window": "monthly",
  "name": "prod-monthly"
}

Reference: dome_gateway_quota_set

The API expresses the limit in millionths of a US dollar. For example, $500 is 500000000.

POST /dome.mgmt.v1.Management/CreateLLMQuota
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "subject_type": "gateway",
  "subject_id": "{{GATEWAY_ID}}",
  "limit_micros": "500000000",
  "window": "monthly",
  "name": "prod-monthly",
  "enabled": true
}

Reference: CreateLLMQuota

Set a cost quota

Create a monthly $500 cost quota named "prod-monthly" for "prod-resources".

Remove a cost quota

Remove a Gateway cost quota to stop enforcing that cap.

Requires gateway.manage.

Removing a quota takes away an active spending control. Confirm the quota ID with the list operation first.

CLI
MCP
API
Agent

dome gateway quota rm {{QUOTA_ID}}

The command rejects quota IDs that belong to another subject type.

Reference: dome gateway quota rm

Tool: dome_gateway_quota_remove

{
  "quota_id": "{{QUOTA_ID}}"
}

The tool rejects quota IDs that belong to another subject type.

Reference: dome_gateway_quota_remove

Confirm that the quota has subject_type: gateway before deleting it. The generic API endpoint does not add the CLI and MCP subject-type guard.

POST /dome.mgmt.v1.Management/DeleteLLMQuota
Content-Type: application/json

{
  "workspace_id": "{{WORKSPACE_ID}}",
  "quota_id": "{{QUOTA_ID}}"
}

Reference: DeleteLLMQuota

Remove a cost quota

Confirm that "{{QUOTA_ID}}" is a Gateway quota, then remove it.

After any quota change, list cost quotas to confirm the active caps and reset windows.

Build the runtime endpoint

Build the runtime endpoint from the workspace gateway host and the Gateway ID. Retrieve the ID with List Gateways.

Requires gateway.view to retrieve the ID. Runtime calls require an active agent key and a grant to the Gateway.

Use the ID in the canonical prefix:

https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}

Choose the base URL that matches the client.

Client	Base URL	Client appends
Dome SDK	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}`	nothing, used as-is
Anthropic SDK	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}`	`/v1/messages` (SDK-managed)
OpenAI-compatible SDK	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/v1`	`/chat/completions`, `/embeddings`, …
MCP client	`https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/mcp`	protocol frames

Do not add /v1 to the Anthropic base URL because the Anthropic SDK appends /v1/messages. Bare /mcp and /v1 requests return HTTP 400. Every caller must select a Gateway in the URL. Run dome gateway get <name-or-id> --json to retrieve the complete gateway_url, mcp_url, openai_base_url, and anthropic_base_url. SDK agent-key creation and token exchange return the same authoritative endpoint set. Refer to Python SDK Gateways.

Verify reachability

Verify discovery before invoking a tool or model. Discovery returns only members of the selected Gateway that the agent’s grant and applicable rules permit.

Requires an active agent key, access to the Gateway, and rules that allow discovery.

List MCP tools through the scoped endpoint:

curl -X POST "https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/mcp" \
  -H "Authorization: Bearer {{DOME_AGENT_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

List model pools and direct model connections through the OpenAI-compatible endpoint:

curl "https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/v1/models" \
  -H "Authorization: Bearer {{DOME_AGENT_KEY}}"

Configure runtime credentials and SDK clients in Develop.

Troubleshoot reachability

Use the observed response to locate the failed layer.

Symptom	Likely cause	Resolution
HTTP `400` asks for a Gateway	The client used bare `/mcp` or `/v1`	Add `/gateways/{{GATEWAY_ID}}` before the protocol path
Gateway is unavailable	The ID is unknown, disabled, or not yet synchronized	Verify the ID, enable the Gateway, and wait for gateway synchronization to complete
Invocation is denied before rules evaluate	The agent lacks access to the Gateway	Add a per-agent or workspace-wide grant
Discovery returns no resources	The agent lacks access, the Gateway has no matching members, or rules deny discovery	Check agent access, membership, and rules
Tool is missing from `tools/list`	The tool lacks membership, is blocked, or rules deny discovery	Check individual and tool-source membership, tool status, and rules
Pool or model is missing from `/v1/models`	The resource lacks membership or rules deny discovery	Check pool or direct-model membership and model rules
Resource shows Unreachable	The resource belongs to no Gateway	Add the resource or its containing tool source or pool
LLM call returns HTTP `429`	A Gateway or other LLM cost quota is exhausted	List active quotas and check their reset windows
Gateway creation is rejected at the plan limit	The workspace already has the maximum number of Gateways	Reuse, rename, or delete the Default gateway, or change plans
Anthropic request returns HTTP `404`	The client base URL includes an extra `/v1`	Use `https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}`

After changing memberships or grants, wait for gateway synchronization before testing again. If discovery succeeds but invocation fails, inspect the resource rules and the agent’s lifecycle state.

Next steps

Gateways concept for how membership and grants work
Register agents to create agent identities and keys
Tools to configure tool connections and catalog state
Pools to configure pools and routing

​Overview

​Resource membership

​Agent access

​Default gateway

​Runtime endpoints

​Cost quotas

​Requirements

​Permissions

​Create Gateway

​Update Gateway

​Get Gateway

​List Gateways

​Set Default gateway

​Manage lifecycle

​Enable Gateway

​Disable Gateway

​Delete Gateway

​Manage resource memberships

​Individual tools

Add individual tool

Remove individual tool

​Tool source

Add tool source

Remove tool source

​Pool

Add pool

Remove pool

​Direct model

Add direct model

Remove direct model

​Manage agent access

​List agent access

​Grant one agent

​Revoke one agent

​Grant every workspace agent

​Revoke every workspace agent

​Manage cost quotas

​List cost quotas

​Set a cost quota

​Remove a cost quota

​Build the runtime endpoint

​Verify reachability

​Troubleshoot reachability

​Next steps

Overview

Resource membership

Agent access

Default gateway

Runtime endpoints

Cost quotas

Requirements

Permissions

Create Gateway

Update Gateway

Get Gateway

List Gateways

Set Default gateway

Manage lifecycle

Enable Gateway

Disable Gateway

Delete Gateway

Manage resource memberships

Individual tools

Tool source

Pool

Direct model

Manage agent access

List agent access

Grant one agent

Revoke one agent

Grant every workspace agent

Revoke every workspace agent

Manage cost quotas

List cost quotas

Set a cost quota

Remove a cost quota

Build the runtime endpoint

Verify reachability

Troubleshoot reachability

Next steps