Skip to main content

List gate servers (deduped)​

Returns one row per distinct gate server (deduped by analytics_correlation_id, latest event per server). Backed by the shared events_dataset.external_events_json firehose today; a dedicated table is a follow-up.

Default lookback when neither start_time nor end_time is provided is 7 days (matches gate's heartbeat cadence so a fresh open reliably lists all live servers). If only one bound is provided, the other is derived using the 7-day default. Same 30-day cap applies when both bounds are provided (end_time - start_time > 30d is rejected with HTTP 400).

Query Parameters
  • limit integer

    Possible values: <= 500

    The maximum number of items to return. Default 50.

  • offset integer

    The number of the first item to return.

  • start_time date-time

    RFC3339 timestamp. Inclusive lower bound on publish_time.

  • end_time date-time

    RFC3339 timestamp. Exclusive upper bound on publish_time.

  • filter string

    SCIM 2.0 filter over GET /gate/server-starts.

    Fields (all optional):

    • event_id: exact-match on the emitted event's UUID.
    • analytics_correlation_id: exact-match on the emitting gate process.
    • version, variant, build_commit: exact-match on the gate build tuple.
    • instance_id: exact-match on the persistent gate installation UUID.
    • service_name: exact-match on the OpenTelemetry service.name.
    • client_ip_address: exact-match on the emitting gate's client IP.

    Supported operators:

    • eq, ne (all fields). Multi-value lookups: chain with or, e.g. foo eq "A" or foo eq "B". The SCIM 2.0 filter parser used here doesn't implement in.
    Example: version eq "1.2.3" and variant eq "enterprise"
Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Responses

OK

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object
  • limit integer
  • cursor string
  • total_count int64
  • errors object[]
  • httpcode integer
  • message string
  • result object[]
  • event_name string

    Possible values: [AuthenticationSucceeded_v1, AuthenticationFailed_v1, PersonCreated_v1, AnonymousPersonCreated_v1, PersonDeleted_v1, VirtualPageLoaded_v1, SlashIDSDKLoaded_v1, PersonIdentified_v1, PersonLoggedOut_v1, TokenMinted_v1, AnonymousTokenMinted_v1, PasswordChanged_v1, GdprConsentsChanged_v1, GateServerStarted_v1, GateRequestHandled_v1, GateHeartbeat_v1, PermissionCreated_InRegion_v1, PermissionCreated_v1, PermissionDeleted_InRegion_v1, PermissionDeleted_v1, RoleCreated_InRegion_v1, RoleCreated_v1, RoleDeleted_InRegion_v1, RoleDeleted_v1, RoleUpdated_InRegion_v1, RoleUpdated_v1, RolesSetToPerson_InRegion_v1, RolesSetToPerson_v1, PermissionsSetToPerson_InRegion_v1, PermissionsSetToPerson_v1, MitmAttackDetected_v1, PermissionUpdated_InRegion_v1, PermissionUpdated_v1, SuborganizationCreated_InRegion_v1, SuborganizationCreated_v1, OAuth2ClientCreated_InRegion_v1, OAuth2ClientCreated_v1, AWSIAMUserCreated_v1, AWSIAMRoleCreated_v1, AWSIAMRoleInlinePoliciesUpdated_v1, AWSIAMRoleManagedPoliciesUpdated_v1, AWSIAMRoleAssumeRolePolicyUpdated_v1, AWSIAMRolePermissionsBoundaryUpdated_v1, AWSIAMRoleDeleted_v1, GCPServiceAccountCreated_v1, GCPRoleCreated_v1, GCPIAMPolicyBindingUpdated_v1, GCPServiceAccountDeleted_v1, ActiveDirectorySPNCreated_v1, ActiveDirectorySPNRoleUpdated_v1, ActiveDirectorySPNDeleted_v1, ActiveDirectoryUserCreated_v1]

  • service_name string

    Human-readable service identity — the OpenTelemetry service.name attribute Gate also emits on traces and logs. Typically set by the operator to the deployment name (e.g. "gate-demo", "slashid-backend"); defaults to "gate".

  • instance_id uuid

    Stable UUID identifying a Gate installation across restarts. Generated on first boot and persisted to disk at monitoring.instance_id_file. When the file cannot be read or written, Gate falls back to the same UUID as analytics_correlation_id — so instance_id == analytics_correlation_id reliably signals "no persistent identity available".

  • version object
  • version string

    Gate release version

  • variant string

    Gate release variant (enterprice, free, etc)

  • build_commit string
  • build_date date-time
  • built_by string
  • comment string

    A user-provided string that can be used to identify the server

  • config object
  • plugins object[]

    Catalog of every configured plugin definition, in plugin_index order.

  • plugin_index integer
  • plugin_id string
  • plugin_type string

    Possible values: [opa, ratelimit, anonymizer, tokenizer, validate-jwt, validate-oauth2-token, request-oauth2-authenticator, token-exchange, token-translation-upgrade, token-translation-downgrade, token-reminting, mirroring, authentication-proxy, enforce-openapi-security, request-validator, e2e-testing]

  • config object
    oneOf
  • plugin_type string

    Possible values: [opa]

  • policy_decision_path string
  • monitoring_mode boolean
  • capture_request_body boolean
  • max_request_body_size integer
  • bundle_source string

    Possible values: [inline, file, http]

  • bundle_url_host string

    Scheme + host only when bundle_source=http; no path/query.

  • intercept_method string

    Possible values: [request, response, request_response]

  • policy_bundle object

    Loaded policy bundle files, keyed by path within the bundle (e.g. auth.rego, subdir/permissions.rego). For inline policies the synthetic path is inline.rego. Base data, when present, appears under the synthetic path data.json.

    Present only when the plugin's config.observability.policy_bundle is true AND the bundle's total uncompressed size fits within Gate's 32 KiB cap. All-or-nothing: bundles over the cap omit this field entirely.

  • property name* string
  • routes object[]

    Every routing branch, in the order Gate consults them at request time: URL patterns in configured declaration order first, then the default branch (its pattern is absent) as the last-resort match-anything entry. routes[len-1] is always the default.

  • pattern string

    fnmatch pattern matched against Host + Path; absent for the default branch (the last entry in routes[]).

  • target string

    Effective upstream URL for this route — denormalized. If the URL pattern's own config specifies a target, that value; otherwise the default branch's target. Absent only when neither this route nor the default configured a target (typically ext_auth/aws_lambda_auth modes, or a broken proxy config).

  • transparent boolean

    Only meaningful on the default branch, and only when target is also absent. When true, unmatched requests with no default target are forwarded to the client's original destination host. When false (schema-default and Gate-default), unmatched requests with no default target are rejected. Ignored on non-default branches.

  • ext_auth_response string

    Possible values: [allow, deny]

    Only meaningful on the default branch, and only when Gate is running in ext_auth mode.

  • aws_lambda_auth_response string

    Possible values: [allow, deny]

    Only meaningful on the default branch, and only when Gate is running in aws_lambda_auth mode.

  • plugins object[]

    Plugins that effectively run on this route, in plugin_index order. Presence in this list implies enabled; disabled plugins are omitted.

  • plugin_id string

    References GateConfigPlugin.plugin_id in the catalog.

  • config object
    oneOf
  • plugin_type string

    Possible values: [opa]

  • policy_decision_path string
  • monitoring_mode boolean
  • capture_request_body boolean
  • max_request_body_size integer
  • bundle_source string

    Possible values: [inline, file, http]

  • bundle_url_host string

    Scheme + host only when bundle_source=http; no path/query.

  • intercept_method string

    Possible values: [request, response, request_response]

  • policy_bundle object

    Loaded policy bundle files, keyed by path within the bundle (e.g. auth.rego, subdir/permissions.rego). For inline policies the synthetic path is inline.rego. Base data, when present, appears under the synthetic path data.json.

    Present only when the plugin's config.observability.policy_bundle is true AND the bundle's total uncompressed size fits within Gate's 32 KiB cap. All-or-nothing: bundles over the cap omit this field entirely.

  • property name* string
  • event_metadata object

    Metadata attached by the backend after ingest. A curated subset of common.EventMetadata from the proto plus one BQ-derived field (publish_time). source is omitted (always "Gate" for these events); event_type/event_name/event_version are already carried by the EventIdentifiers slice of the embedded ingress schema.

  • event_id uuid
  • timestamp string

    RFC3339Nano — client-set, when gate emitted the event.

  • publish_time date-time

    Pub/Sub ingest time, from the BigQuery table column. Not on the proto. Endpoints order by this field.

  • organization_id uuid
  • root_organization_id uuid
  • analytics_correlation_id uuid

    Per-gate-process identifier. Same value across every event emitted by one gate process (including its heartbeats); a new value on process restart.