Kong AI Gateway + Meridian gateway ingest

Name: Meridian
Brand: Onaro

Status: Beta · 2026-09-22
Egress: api.onaro.io:443 (HTTPS)

Meridian ingests Kong AI audit logs (http-log plugin on AI Gateway routes) and maps them to OASA 0.2.0. Kong remains in your environment; Meridian stores no Kong admin credentials for ingest.

Prerequisites

Kong Gateway 3.9.x with AI Gateway / ai-proxy (AI audit log reference)
Meridian ingest key (meridian:ingest) as Bearer token
HTTPS egress to https://api.onaro.io

Ingest endpoint

POST https://api.onaro.io/v1/meridian/ingest/gateways/kong
Authorization: Bearer MERIDIAN_INGEST_KEY
Content-Type: application/json

Declarative config

Use the companion template Kong_AI_Gateway_Meridian.yaml (same folder). Substitute placeholders at deploy time:

Placeholder	Purpose
`MERIDIAN_INGEST_URL`	Full ingest URL (see above)
`MERIDIAN_INGEST_KEY`	Bearer token
`MERIDIAN_KONG_SERVICE_NAME`	Your AI service name
`MERIDIAN_KONG_ROUTE_NAME`	Route name
`MERIDIAN_UPSTREAM_AI_URL`	Upstream LLM base URL

The template wires:

ai-proxy (or AI Gateway route) for model traffic
http-log pointing at Meridian with Authorization: Bearer MERIDIAN_INGEST_KEY

Identity: registry mode (primary)

Kong audit logs expose consumer / credential identifiers. Meridian resolves gateway_key_ref from consumer username, credential id, or client IP (first non-empty).

Registry mode is primary for Kong: map each observed ref in Meridian → Settings → Gateway key registry (gateway=kong). CSV bulk upload supported.

Declared metadata in upstream requests is not required when registry rows exist.

Verification

Issue one authenticated AI request through the Kong route.
Confirm http-log delivery returns success from Kong’s perspective.
Check Meridian usage for the mapped agent.
Map any Unmapped gateway_key_ref rows in the registry UI.

Template: Kong_AI_Gateway_Meridian.yaml
Payload pins: docs/INGEST-3-gateway-payloads.md

Kong AI Gateway + Meridian