Gateway Configuration Inspection

How to inspect the live configuration of a running Tyk Gateway using the built-in configuration inspection endpoints.

Availability

Component	Version	Edition
Gateway	Available since v5.12.0	All

To inspect the gateway’s live configuration without SSH access, you can enable configuration inspection endpoints on the Control API port.

Configuration Inspection Endpoints

Gateway offers two endpoints for configuration inspection:

Endpoint	Query Parameter	Description
GET /config	field=<path> (optional)	Returns the full gateway configuration, or a single field if field is specified
GET /env	env=<VAR> (optional)	Returns all environment variable mappings, or a single mapping if env is specified

Both endpoints are available on the Control API port and require authentication via the X-Tyk-Authorization header. Requests without this header return HTTP 403.

Enable Configuration Inspection

By default, configuration inspection endpoints are disabled to prevent accidental exposure of sensitive information. When disabled, all configuration inspection endpoints return HTTP 404.

To enable it, set enable_config_inspection to true in your tyk.conf or use the equivalent environment variable.

In production environments, we recommend keeping configuration inspection disabled.

Configuration File

{
  "enable_config_inspection": true
}

Environment Variable

TYK_GW_ENABLECONFIGINSPECTION=true

Examples

Inspect Full Gateway Configuration

curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" http://localhost:8080/config

Response:

{
  "hostname": "",
  "listen_address": "",
  "listen_port": 8080,
  "control_api_hostname": "",
  "control_api_port": 0,
  "secret": "*REDACTED*",
  "node_secret": "*REDACTED*",
  "pid_file_location": "./tyk-gateway.pid",
  "allow_insecure_configs": true,
  "public_key_path": "",
  "allow_remote_config": true,
  "enable_config_inspection": true,
  "security": {
  }
...
}

Inspect a Single Config Field

To retrieve the value of a specific configuration field, use the field query parameter with the field name:

curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" \
  "http://localhost:8080/config?field=listen_port"

Response:

{
  "config_field": "listen_port",
  "env": "TYK_GW_LISTENPORT",
  "value": "8080",
  "obfuscated": false
}

Sensitive Field Redaction

Fields that contain secrets (for example, secret, passwords, and connection strings) are automatically shown as *REDACTED* in all responses. The obfuscated field in the response indicates whether the value has been redacted.

{
  "config_field": "secret",
  "env": "TYK_GW_SECRET",
  "value": "*REDACTED*",
  "obfuscated": true
}

Inspect Environment Variables

To view all environment variable mappings:

curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" http://localhost:8080/env

Gateway will only return environment variables that are prefixed with TYK_GW_.

Response:

[
  "TYK_GW_ENABLECONFIGINSPECTION=true",
  "TYK_GW_EXPERIMENTALPROCESSORGOFFTHREAD=false",
  "TYK_GW_GRACEFULSHUTDOWNTIMEOUTDURATION=0",
  "TYK_GW_CONTROLAPIPORT=0",
  "TYK_GW_TEMPLATEPATH=./templates",
  "TYK_GW_SSLFORCECOMMONNAMECHECK=false",
  "TYK_GW_ENABLEBUNDLEDOWNLOADER=false",
  "TYK_GW_JSVMTIMEOUT=0",
  "TYK_GW_FORCEGLOBALSESSIONLIFETIME=false",
  "TYK_GW_DISABLEDASHBOARDZEROCONF=false",
  "TYK_GW_MANAGEMENTNODE=false",
...
]