put_v1_gateway_config
Write updates one policy scope and returns the policy in force after the write.
Write updates one policy scope and returns the policy in force after the write. A body carrying any PLATFORM field (cors_origins, per_ip_rpm, window_sec) is a platform write and requires SuperAdmin; otherwise it is a per-org write (org_rpm, cache_ttl_sec, cache_paths, methods) scoped to the caller's own org — or, for a SuperAdmin, the tenant named by ?org=<slug>. A body that sets nothing is a 400. updated_at and updated_by are server-stamped; a client-supplied value is ignored.
| Tool | put_v1_gateway_config |
| Door | https://api.hanzo.ai/v1/mcp |
| Method | tools/call (JSON-RPC 2.0) |
| Arguments | 9 |
| Operation | PUT /v1/gateway/config |
| Product | gateway |
Arguments
| Field | Type | Required | Default | Values | Description |
|---|---|---|---|---|---|
cache_paths | object | — | — | — | CachePaths overrides CacheTTLSec per path PREFIX (key "/v1/models" → seconds). The longest matching prefix wins. |
cache_ttl_sec | integer | — | — | — | CacheTTLSec is the org's default edge-cache TTL for its responses, in seconds; 0 means no caching. Unset inherits the platform default. |
cors_origins | string[] | — | — | — | CORSOrigins is the PLATFORM-scope CORS allowlist EdgeCORS admits: an exact origin, a bare host, or a "*.host" wildcard. Writable only by a SuperAdmin — CORS is evaluated before identity, so it has no tenant to scope to. |
methods | string[] | — | — | — | Methods is the allowlist of HTTP methods the edge accepts for this org. Empty means all are accepted. |
org_rpm | integer | — | — | — | OrgRPM is the org's OWN authenticated rate ceiling, requests per minute, as ScopeRateLimit enforces it. Unset inherits the platform default, then the static boot default. |
per_ip_rpm | integer | — | — | — | PerIPRPM is the PLATFORM-scope pre-auth flood cap: requests EdgeRateLimit admits per WindowSec from one client IP. SuperAdmin-only, same reason. |
updated_at | integer | — | — | — | UpdatedAt is the unix second this policy row was last written. Server-stamped; a client-supplied value is ignored. |
updated_by | string | — | — | — | UpdatedBy is the validated user id that wrote this policy row. Server-stamped; a client-supplied value is ignored. |
window_sec | integer | — | — | — | WindowSec is the window PerIPRPM is counted over, in seconds. SuperAdmin-only. |
tools/list declares a type and a description for each field and nothing further. A — means neither the door nor that operation constrains the field.
Call it
A tools/call carries every argument in one flat object — nothing binds to a path or a query string. Nothing above is required, so every declared argument is shown rather than a guess at which matter.
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "put_v1_gateway_config",
"arguments": {
"cache_paths": {},
"cache_ttl_sec": 0,
"cors_origins": [
"<cors_origins>"
],
"methods": [
"<methods>"
],
"org_rpm": 0,
"per_ip_rpm": 0,
"updated_at": 0,
"updated_by": "<updated_by>",
"window_sec": 0
}
}
}'Values are the operation's own defaults and enumerated values where it declares them, and a <placeholder> where neither source declares one. cache_ttl_sec, org_rpm, per_ip_rpm, updated_at and window_sec hold stand-ins that cannot be spelled that way — JSON gives a number, a boolean and a timestamp no placeholder form — so those values are this page's, not the API's. Neither the door nor the operation declares one. tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →
The operation behind it
| Operation | Route | Product | Summary |
|---|---|---|---|
put_v1_gateway_config | PUT /v1/gateway/config | gateway | Write updates one policy scope and returns the policy in force after the write. |
The same capability over plain HTTP is in the gateway API reference, on https://api.hanzo.ai.
All 755 tools · The door · API reference
Generated from tools/list on https://api.hanzo.ai/v1/mcp — 833 tools captured 2026-08-01, of which 755 are documented here (the operator surface is not published) (this build read the vendored copy; the door was unreachable).
How is this guide?