Contact Us 1-800-596-4880
  1. Homepage
  2. Exchange
  3. Administrator Tasks
  4. Discovering and Cataloging External Services with Scanners
  5. API Scanners

  6. Adding a Scanner for Kong Gateway

Adding a Scanner for Kong Gateway

Add a scanner to discover, import, and sync APIs from Kong Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal.

In Kong, policies are called plugins. The scanner discovers plugins attached to Kong Gateway services and routes, and the enhanced MuleSoft experience shows those discovered plugins as policies. Plugins applied directly at the service instance level are not currently scanned.

Before You Begin

Before adding the scanner, verify that you have these prerequisites:

  • Exchange Administrator permission

  • Kong Control Plane Viewer permission

  • Kong Gateway region

  • Personal access token (PAT)

Credential scope required for discovering and reading policies:

  • Kong Admin API read

Setup for OpenAPI Specifications:

Before you run the scanner, link each Kong Gateway service to a Catalog API that has an attached OpenAPI Specification (OAS) so that discovery produces accurate, typed API definitions. For the required workflow and route-discovery limitations, see OpenAPI Specifications.

OpenAPI Specifications

To discover accurate, typed API definitions from Kong Gateway, link each Kong Gateway service to a Catalog API that has an attached OpenAPI Specification (OAS). The scanner reads the OAS from the linked Catalog API to build a complete, typed service definition.

Uploading an OAS file directly to a Kong Gateway service only creates Kong routes—it doesn’t store a spec or endpoint definition that the scanner can read. Without a Catalog-linked spec, Kong infers routes from the gateway configuration. Inferred routes are untyped and produce a lower-quality service definition and degraded MCP bridging.

To attach an OAS so the scanner can read it:

  1. In the Kong Catalog section, create an API.

  2. Attach the OAS spec to the Catalog API.

  3. Link the Catalog API to a gateway service in Kong Gateway.

For more information, see the Kong API catalog documentation.

If a Kong Gateway service isn’t linked to a Catalog API with an attached OAS, only the first route per path is discovered. For example, if the /items path has both GET and POST routes, only one of those routes appears in the discovered definition. Link the service to a Catalog API with an attached OAS to discover all routes and methods for each path.

Add a Scanner for Kong Gateway

  1. Verify that you are in the business group where you want to add the scanner.

  2. From the sidebar in Exchange, click Scanners.

  3. Enter a name for the scanner.

  4. From Scanner Run Configuration, complete these fields or options:

    Field/Option Value

    Run Schedule

    Select a frequency and local time.

    Sync Review

    Select an option: Auto-resolve or Ask to review.

  5. From Connection Configuration, complete these fields:

    Field Value

    Provider

    Select Kong.

    Platform

    Select Kong Gateway.

    Service Type

    REST APIs selected by default.

    Authentication Method

    Service Account selected by default.

    Kong Gateway Region

    Select the Kong Gateway region.

    Personal Access Token

    Enter the personal access token.

  6. Click Test Connection.

    If the connection fails, review the Connection Configuration settings. Update the settings, and then test the connection again.

  7. To send email notifications:

    1. Select Advanced Settings and turn on Send Email Notifications.

    2. Enter an email address.

  8. Click Add Scanner.

Protocol to Asset Type Mapping

When the scanner discovers an API in Kong Gateway, it assigns an asset type in Exchange based on the API’s Kong protocol and plugins.

Protocol Plugin Asset type

grpc / grpcs

—

gRPC

http / https

graphql-*

GraphQL

http / https

No matching plugin

REST

The scanner currently detects gRPC and GraphQL protocols only.

APIs that use other protocols or plugins, such as Model Context Protocol (MCP), WebSocket, or Simple Object Access Protocol (SOAP), are registered in Exchange as asset type REST for now. MuleSoft plans to support these protocols in a future release.

Rescanning Behavior

The scanner assigns an asset type to an API the first time it discovers that API in Exchange. Later scans do not update that asset type, even if the API’s protocol changes in Kong Gateway. To change an asset’s type, remove the asset from Exchange, and let the scanner import it again.

See Also