AI Gateway management API reference (legacy gateway)
This page covers the legacy AI Gateway, which runs through the AI Gateway
operator and AIGateway resources. For the current AI Gateway, see
AI Gateway endpoints reference. To check which
gateway you run, see
Identify your deployment.
The legacy AI Gateway management API exposes caller identity and gateway-wide
model and MCP server catalogs. It reads the owning AIGateway resource through
the Kubernetes API. See
Configure the legacy AI Gateway
for deployment and Legacy AI Gateway for configuration guides.
Base URL
The operator creates this Service in the AIGateway resource's namespace when
spec.auth.virtualAPIKeys.enabled is true. <AIGATEWAY_NAME> is the
resource's metadata.name. The management API uses HTTP port 8080; the
gateway's model inference endpoint serves model requests separately. To expose
the management API externally, route to this Service and use that route's HTTPS
base URL.
With the default Service name and port, the in-cluster base URL is:
http://<AIGATEWAY_NAME>-api-key-service.<NAMESPACE>.svc:8080
Check that the Service exists and confirm its ports:
kubectl get svc -n <NAMESPACE>
For a local connection, forward the Service's HTTP port:
kubectl port-forward -n <NAMESPACE> svc/<SERVICE_NAME> 8080:8080
Replace <SERVICE_NAME> with the installed Service name. Keep the command
running in a separate terminal. Your local base URL is http://localhost:8080.
Append each endpoint path to the base URL once; for example,
http://localhost:8080/v1/me. API authentication still applies when using a
port-forward.
For external access, ask your platform administrator for this API's HTTPS base
URL. To publish it, configure your ingress or gateway controller to route to
<AIGATEWAY_NAME>-api-key-service on port 8080 in the Service's namespace,
using the installed name and port if overridden.
For routing and verification steps, see Publish and verify the legacy gateway endpoints.
The interactive reference uses http://localhost:8080, which matches the
port-forward above. For calls from inside the cluster or through an external
endpoint, replace that address with your deployment's base URL.