Appearance
Security and RBAC
BETA
Agent Gateway is in BETA, and we're continuing to expand its capabilities. Your feedback helps shape what we build next—reach out to us through Relewise Support.
Agent Gateway uses Personal Access Tokens, Agent Gateway Configuration, and My Relewise permissions to decide whether a request is allowed.
Permissions
Agent Gateway has two Dataset permissions.
| Permission | What It Allows |
|---|---|
| Manage Agent Gateway | View and update Agent Gateway settings for a Dataset. This permission also includes Use Agent Gateway. |
| Use Agent Gateway | Use Personal Access Tokens to access the Dataset through Agent Gateway. |
Users with the Administrator role have access by default.
Members do not get Agent Gateway permissions by default. An Administrator or a user with Manage Members can grant the relevant permissions.
Authentication
Agent Gateway uses bearer-token authentication.
Send the Personal Access Token in the Authorization header:
http
Authorization: Bearer <personal-access-token>The token identifies the My Relewise user who created it. Agent Gateway verifies that the user still exists and is enabled.
Authorization Gates
Agent Gateway authenticates the Personal Access Token before evaluating Dataset authorization. The token must exist, must not be expired or revoked, and its secret must match the stored token hash.
Missing, invalid, expired, and revoked tokens are rejected with 401 Unauthorized and do not appear in Request Logs.
After authentication succeeds, the request is allowed only when all of these authorization checks pass:
- The token is available for the requested Dataset.
- The Dataset exists.
- The user has Use Agent Gateway for the Dataset.
- Agent Gateway is enabled for the Dataset.
- The requested Connection Method is enabled for the Dataset.
- The requested Allowed Area is enabled for the Dataset.
Agent Gateway records the outcome and failure reason for requests that reach these authorization checks.
Public Routes
When Agent Gateway is accessed through My Relewise, public routes are exposed under https://my.relewise.com/agents.
Use https://my.relewise.com/agents/ to open the interactive API reference for the Agent Gateway REST API.
Use https://my.relewise.com/agents/{Dataset ID}/mcp when connecting an MCP client. The MCP client discovers available tools after it connects.
Internal Agent Gateway routes are not exposed through the My Relewise reverse proxy.