List config

Returns the EFFECTIVE edge policy the caller is subject to: the platform CORS allowlist and pre-auth per-IP flood cap in force, plus the caller's own authenticated rate ceiling, edge-cache TTLs and accepted-method allowlist.

GET /v1/gateway/config

Addresshttps://api.hanzo.ai/v1/gateway/config
MethodGET
Operationget_gateway_config
AuthAuthorization: Bearer $HANZO_API_KEY

Returns the EFFECTIVE edge policy the caller is subject to: the platform CORS allowlist and pre-auth per-IP flood cap in force, plus the caller's own authenticated rate ceiling, edge-cache TTLs and accepted-method allowlist. A SuperAdmin may inspect a specific tenant's effective policy with ?org=<slug>.

Request

GET /v1/gateway/config takes no parameters and no body — the credential is the whole request.

Response

StatusBodyMeaning
200gateway.Policyok
defaultproblem-detailsrefused

200 body — 11 fields.

FieldInTypeAlwaysDescription
cache_pathsbodyobject—CachePaths overrides CacheTTLSec per path PREFIX (key "/v1/models" → seconds).
cache_paths.*bodyinteger (int64)—
cache_ttl_secbodyinteger (int64)—CacheTTLSec is the org's default edge-cache TTL for its responses, in seconds; 0 means no caching.
cors_originsbodystring[]—CORSOrigins is the PLATFORM-scope CORS allowlist EdgeCORS admits: an exact origin, a bare host, or a "*.host" wildcard.
methodsbodystring[]—Methods is the allowlist of HTTP methods the edge accepts for this org.
modebodystring—Mode is the abuse gate's posture for THIS scope: "shadow" scores traffic and records the verdict without acting on it, "live" enforces it.
org_rpmbodyinteger (int64)—OrgRPM is the org's OWN authenticated rate ceiling, requests per minute, as ScopeRateLimit enforces it.
per_ip_rpmbodyinteger (int64)—PerIPRPM is the PLATFORM-scope pre-auth flood cap: requests EdgeRateLimit admits per WindowSec from one client IP.
updated_atbodyinteger (int64)—UpdatedAt is the unix second this policy row was last written.
updated_bybodystring—UpdatedBy is the validated user id that wrote this policy row.
window_secbodyinteger (int64)—WindowSec is the window PerIPRPM is counted over, in seconds.

Failure carries the platform error shape — see Errors.

Examples

hanzo gateway config get
import { Configuration, GatewayApi } from 'hanzoai';

const api = new GatewayApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getGatewayConfig();
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import GatewayApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = GatewayApi(client).get_gateway_config()
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.GatewayAPI.GetGatewayConfig(context.Background()).Execute()
if err != nil {
	return err
}
use hanzo_client::apis::{configuration::Configuration, gateway_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = gateway_api::get_gateway_config(&cfg, Default::default()).await?;
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.GatewayApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new GatewayApi(client).getGatewayConfig();
curl https://api.hanzo.ai/v1/gateway/config \
  -H "Authorization: Bearer $HANZO_API_KEY"

Tool gateway, op get_gateway_config — POST the JSON-RPC envelope to https://api.hanzo.ai/v1/mcp.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "gateway",
         "arguments": {
           "op": "get_gateway_config",
           "input": {}
         }
       }
     }'

Gateway API · All Hanzo APIs · Interactive reference

Was this page useful?