Gateways
For: Platform operators managing a fleet of self-hosted Axemere gateways.
Gateways | Connect | Gateway Keys | Automation Keys
The Gateways page is the control plane view for your self-hosted gateway fleet: enroll new gateways, monitor fleet health, and track request volume and policy enforcement across all gateways.
Navigation: console.axemere.ai/gateways
Table of Contents
Fleet Stats
Four summary cards at the top of the page show the current health of your gateway fleet:
| Card | Description |
|---|---|
| Total Gateways | All self-hosted gateways registered to your organization |
| Active Gateways | Gateways with a heartbeat in the last 24 hours, indicating the gateway is online and processing traffic |
| Requests | Total API requests routed across all gateways in the selected time window (1h / 6h / 24h) |
| Blocked | Requests rejected by policy (rate limits, content filters, access controls) in the selected window |
A gateway with no heartbeat in 24 hours is considered inactive. If Active Gateways drops below Total Gateways, check individual gateways for connectivity issues.
Fleet Traffic Chart
The Fleet Traffic chart plots requests and blocked requests across all gateways over the selected time window. Use the window selector (1h / 6h / 24h) in the top-right of the chart to adjust the range.
- Requests (blue area): total requests routed through the fleet
- Blocked (red line): requests denied by policy
A spike in Blocked without a corresponding spike in Requests typically indicates a policy rule triggered by a specific workload or content pattern rather than a traffic surge.
Self-Hosted Gateways Table
The Self-Hosted Gateways table lists every enrolled gateway. Each row shows:
| Column | Description |
|---|---|
| Gateway ID | The MVGC_NODE_ID value set when the gateway was started |
| Status | One of six states, cert revocation and CP-level suspension taking precedence over activity: revoked, suspended, active (heartbeat < 1h), healthy (< 24h), stale (< 7d), or offline (no heartbeat in 7+ days, or never) |
| Last Seen | Time of the most recent heartbeat from the gateway |
| Enrolled | Date the gateway completed enrollment |
| Credentials | Shows N assigned (node-scoped credentials) or org-wide; an amber none warning means no credential resolves for this gateway at all |
| Export | Shows N org defaults in use, or an amber none warning if nothing is configured |
| Policy | custom badge if this gateway has its own policy overlay, otherwise org default |
Switch between List and Map view above the table using the toggle in the top-right. Click any row to open its Gateway Detail Panel.
Below the gateway table, a separate Enrollment Tokens panel tracks bootstrap tokens: the credentials used to enroll a gateway, not the gateways themselves. It has its own Label / Status / Gateway / Used At / Created / Expires / Actions columns, and status tabs (Active / Enrolled / Expired / Revoked / All) to filter by token state. Use it to audit outstanding tokens that haven't been used yet, or to revoke a token before it's redeemed.
Gateway Detail Panel
Click any row in the Self-Hosted Gateways table to open a slide-over panel for that gateway:
- Activity (last 24h) — a request-volume chart and, when available, approximate geographic location.
- Credentials tab — every credential resolved for this gateway, grouped into Org-wide (applies automatically) and gateway-specific assignments.
- Export tab — an Inherit org defaults toggle (org-level export destinations only apply as a fallback when this gateway has no destinations of its own) plus the gateway's own destinations, addable directly from this panel.
- Policy tab — whether this gateway runs a custom policy overlay or the org default, with an Effective Policy accordion to inspect the fully-resolved policy actually enforced.
- Lifecycle actions: Suspend Gateway (with a required reason) / Unsuspend Gateway, and Revoke certificate — revoking forces the gateway to re-enroll with a new bootstrap token.
Enrolling a Gateway
Click + Enroll Gateway (Admin or Owner role required) to open the enrollment flow, which has two steps:
- Enroll a Gateway: enter a label for the gateway and click Generate Token to create a bootstrap token.
- Deploy Your Gateway: the dialog shows a platform-specific install command with the bootstrap token embedded, across six tabs:
| Platform | Method |
|---|---|
| Docker | docker run with environment variables |
| macOS | Homebrew tap + binary |
| Linux | Direct binary download |
| Windows | Direct binary download |
| Kubernetes | Helm chart |
| .env file | Environment file for custom deployment tooling |
The bootstrap token is shown once, embedded in the install command. Once the gateway connects and enrolls, it stores its configuration locally and no longer needs the token. If a gateway is reset or re-imaged, generate a new bootstrap token.
See the install quickstart guides for platform-specific step-by-step instructions.
Related: Connect | Gateway Keys | Automation Keys | Export Destinations | Control Plane Connectivity