> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Gateways

> A gateway is the top-level tenant in TrustGate — addressed by a slug, it owns the registries, consumers, auth, policies, and roles beneath it.

A **gateway** is the top-level isolation boundary. Everything else — registries,
consumers, auth credentials, policies, roles — belongs to exactly one gateway. You can run
many gateways on one TrustGate deployment (one per team, environment, or product).

A gateway is addressed by its **`slug`**, a DNS-safe label
(`^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$`). The proxy resolves the gateway from the slug —
either via the `X-AG-Gateway-Slug` header or the request host (see
[gateway discovery](/trustgate/architecture#gateway-discovery)).

## What a gateway holds

| Field            | Meaning                                                                                                    |
| ---------------- | ---------------------------------------------------------------------------------------------------------- |
| `name` / `slug`  | Display name and DNS-safe identifier.                                                                      |
| `status`         | `active`.                                                                                                  |
| `domain`         | Optional custom hostname for the proxy.                                                                    |
| `metadata`       | Free-form string map (e.g. `{"team_id": "…"}`).                                                            |
| `telemetry`      | Per-gateway telemetry exporters and trace toggles — see [Telemetry](/trustgate/observability/telemetry).   |
| `client_tls`     | Per-upstream TLS settings (keyed by hostname) — see [Server security](/trustgate/operate/server-security). |
| `session_config` | Session affinity: `{ enabled, header_name, body_param_name }`.                                             |

The Admin API also returns derived `proxy_url` and `mcp_url` fields built from
`GATEWAY_BASE_DOMAIN` / `MCP_BASE_DOMAIN` and the slug.

## Session affinity

When `session_config.enabled` is true and a session id is present (from the configured
header or body field), the proxy pins that conversation to the same consumer context on
subsequent requests — useful for stateful routing and consistent load-balancer selection.

## Managing gateways

Create, list, update, and delete gateways through the Admin API under `/v1/gateways`. See
the [Gateways API](/trustgate/api/overview). Deleting a gateway cascades to everything it
owns and publishes a cache-invalidation event so the proxy drops it immediately.