Gateway Routing

All vendor queries to MLS data flow through Conduit's gateway. The gateway is a transparent proxy that authenticates, rate-limits, applies governance policies, and logs every request.

Gateway URL format

https://gateway.conduitapi.dev/s/{org-slug}/{server-slug}

Each MLS registers its data feed as a server. The gateway URL is deterministic based on the MLS organization slug and server slug. You'll receive the specific URL when your access request is approved.

Request flow

Your App ──► Conduit Gateway ──► MLS Data Feed
                 │
                 ├── 1. Validate Bearer token
                 ├── 2. Resolve governance context
                 ├── 3. Check MLS policy rate limits
                 ├── 4. Forward JSON-RPC to upstream
                 ├── 5. Apply field-level filtering
                 ├── 6. Add governance headers
                 ├── 7. Log to audit trail
                 └── 8. Return governed response

Supported transports

Streamable HTTP (recommended)

Standard HTTP POST with optional streaming responses via Server-Sent Events. The default for MCP 2025-06-18+.

bash
POST /s/mls-org/reso-feed
Content-Type: application/json
Authorization: Bearer cnd_live_xxx

{"jsonrpc":"2.0","method":"tools/call","params":{"name":"search_properties","arguments":{"city":"Austin"}},"id":1}

Server-Sent Events (legacy)

Opens an SSE connection for receiving messages and sends requests via a separate POST endpoint. Supported for backward compatibility.

GET /s/mls-org/reso-feed/sse
Authorization: Bearer cnd_live_xxx
Accept: text/event-stream

Session management

For Streamable HTTP, the gateway forwards the Mcp-Session-Id header between client and upstream. If the upstream server returns a session ID, include it in subsequent requests to maintain session state.

[i]Stateless enforcement

When an MLS policy has require_stateless: true, the gateway adds an X-Conduit-Stateless: true header. Vendors should not rely on server-side session state in governed contexts.

Transparent proxy behavior

The gateway passes JSON-RPC messages through without modification (except for governed field filtering). Your Conduit API key is stripped and replaced with the MLS's upstream credentials before forwarding. The upstream server never sees your key.

Headers added by the gateway to upstream requests:

HeaderDescription
X-Conduit-Org-IdYour organization ID
X-Conduit-Key-IdAPI key identifier
X-Conduit-GovernedSet to "true" for governed requests
X-Forwarded-ForClient IP address

[!]No header spoofing

Inbound X-Conduit-* headers are stripped by the gateway before forwarding. You cannot spoof identity headers.

Health endpoint

bash
GET https://gateway.conduitapi.dev/health

→ {"status":"ok","version":"1.0.0"}