HTTP Gateway integration

1. Register your API

target_url is your API's base URL. audience is the aud value your delegation tokens should carry. upstream_auth is optional — the bearer token AGF sends to your API, if it requires one. Requires a Growth plan or above.

curl -X POST https://api.agentgovernancefoundation.com/v1/http-gateways \
  -H "X-AGF-Key: agfk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "billing-api",
    "target_url": "https://billing.internal.acme.com",
    "audience": "billing-prod",
    "upstream_auth": "your-apis-own-bearer-token"
  }'

Response includes the gateway ID you'll route traffic to. The secret is never echoed back.

{
  "id": "c3d4e5f6-...",
  "name": "billing-api",
  "target_url": "https://billing.internal.acme.com",
  "audience": "billing-prod",
  "enabled": true,
  "log_request_body": false,
  "timeout_ms": 30000
}

2. Call the gateway instead of your API directly

The gateway mirrors your API's own path structure under /http/{gateway_id}/... — any path, any method, any content type. Safe methods pass through untouched:

curl https://api.agentgovernancefoundation.com/http/c3d4e5f6-.../invoices/123 \
  -H "X-AGF-Key: agfk_your_key_here"

# GET is a safe method — passes straight through, no chain needed

Unsafe methods need a delegation chain in X-AGF-Chain:

curl -X POST https://api.agentgovernancefoundation.com/http/c3d4e5f6-.../invoices \
  -H "X-AGF-Key: agfk_your_key_here" \
  -H "X-AGF-Chain: [\"eyJhbGciOi...\"]" \
  -H "Content-Type: application/json" \
  -d '{"customer_id": "cus_123", "amount_cents": 420000}'

What a blocked request looks like

Unlike the MCP and A2A gateways, this one speaks plain HTTP back to you — real status codes, not a JSON-RPC envelope, since a REST client already expects those:

{
  "error": "AGF_DECISION_DENY",
  "message": "AGF decision: DENY",
  "artifact_id": "dec_...",
  "approval_request_id": null
}
// HTTP 403

Which methods get a decision

No per-route configuration yet — classification is purely by verb. action.resource is the raw path with no template normalization, so /invoices/123 and /invoices/456 are different resource strings today.