Skip to Content
GatewaysTool scoping

Tool scoping

Tool scoping decides which tools a gateway offers. Each gateway offers only the tools you picked, so you can give each audience exactly what it needs: a partner gets “look up an order” but not “issue a refund”, while your own support team’s gateway has both. Nothing is offered until you choose it.

You pick a gateway’s tools when you create it, and change them any time on its Tool scoping tab.

Assigning tools on the gateway Tool scoping tab

Choose the tools

  1. Open the gateway and click the Tool scoping tab. The tab shows how many tools it offers out of how many you have.
  2. Search the tools (they are grouped by the API they came from) and click Assign next to each one to offer. A draft or inactive tool has to be activated on Tools first. A tool private to you can only be offered through a gateway private to you, and a team’s tool only through a gateway scoped to that team.
  3. To take a whole API at once, tick the box on its group.
  4. Click Remove to stop offering a tool.

The buttons at the top pick tools by their names, as a quick start. Check the result before relying on it:

ButtonWhat it assigns
Read onlyTools that use the GET method or have “get” in their name
Admin toolsTools with “admin”, “delete” or “update” in their name
Public APIEvery tool except those with “delete” or “admin” in their name
All toolsEvery tool
Remove allRemoves every tool from the gateway

Limit where a tool may reach

Each assigned tool has a shield button that opens its Security policy on this gateway. Use it to narrow what the tool may do when called through this gateway:

  • Allowed domains and Blocked domains: which web addresses the tool may call.
  • Allowed HTTP methods: for example only GET, so the tool can read but not change anything.
  • Max response size (bytes): cut off very large answers.
  • Require HTTPS: refuse unencrypted calls.

Click Save policy. The same tool can be locked down on a partner gateway and unrestricted on your internal one, because the policy belongs to the tool’s place on that gateway, not to the tool.

Common setups

  • For a partner: only the read tools they need, an API key per partner, and a security policy allowing only GET.
  • For your own team: all the tools, signed in with OAuth.
  • Per team: a separate gateway per team (support gets the order tools, finance the billing tools), each with its own keys.

See Gateway authentication for keys and sign-in.

For developers

An assignment’s settings are stored on the gateway-tool link. The security policy looks like this:

{
  "securityPolicy": {
    "allowedDomains": ["api.northwind.example"],
    "blockedDomains": [],
    "allowedHttpMethods": ["GET"],
    "maxResponseSizeBytes": 1048576,
    "requireHttps": true
  }
}

A request the policy refuses returns a failed tool result with the reason. The link also carries isActive, and optional transformations.inputMapping and transformations.outputMapping that rename a tool’s input and output fields on this gateway only.

Usage. GET /gateways/:gatewayId/tools/stats returns the gateway’s tool counts (totalTools, activeTools, inactiveTools), its totalUsage, and its mostUsedTools and recentlyUsedTools.

Skills gatewayUTCP gateway