Gateway Routing
All vendor queries to MLS data flow through Conduit's gateway. The gateway is a transparent proxy that authenticates, rate-limits, applies governance policies, and logs every request.
Gateway URL format
https://gateway.conduitapi.dev/s/{org-slug}/{server-slug}Each MLS registers its data feed as a server. The gateway URL is deterministic based on the MLS organization slug and server slug. You'll receive the specific URL when your access request is approved.
Request flow
Your App ──► Conduit Gateway ──► MLS Data Feed
│
├── 1. Validate Bearer token
├── 2. Resolve governance context
├── 3. Check MLS policy rate limits
├── 4. Forward JSON-RPC to upstream
├── 5. Apply field-level filtering
├── 6. Add governance headers
├── 7. Log to audit trail
└── 8. Return governed responseSupported transports
Streamable HTTP (recommended)
Standard HTTP POST with optional streaming responses via Server-Sent Events. The default for MCP 2025-06-18+.
POST /s/mls-org/reso-feed
Content-Type: application/json
Authorization: Bearer cnd_live_xxx
{"jsonrpc":"2.0","method":"tools/call","params":{"name":"search_properties","arguments":{"city":"Austin"}},"id":1}Server-Sent Events (legacy)
Opens an SSE connection for receiving messages and sends requests via a separate POST endpoint. Supported for backward compatibility.
GET /s/mls-org/reso-feed/sse Authorization: Bearer cnd_live_xxx Accept: text/event-stream
Session management
For Streamable HTTP, the gateway forwards the Mcp-Session-Id header between client and upstream. If the upstream server returns a session ID, include it in subsequent requests to maintain session state.
[i]Stateless enforcement
require_stateless: true, the gateway adds an X-Conduit-Stateless: true header. Vendors should not rely on server-side session state in governed contexts.Transparent proxy behavior
The gateway passes JSON-RPC messages through without modification (except for governed field filtering). Your Conduit API key is stripped and replaced with the MLS's upstream credentials before forwarding. The upstream server never sees your key.
Headers added by the gateway to upstream requests:
| Header | Description |
|---|---|
X-Conduit-Org-Id | Your organization ID |
X-Conduit-Key-Id | API key identifier |
X-Conduit-Governed | Set to "true" for governed requests |
X-Forwarded-For | Client IP address |
[!]No header spoofing
X-Conduit-* headers are stripped by the gateway before forwarding. You cannot spoof identity headers.Health endpoint
GET https://gateway.conduitapi.dev/health
→ {"status":"ok","version":"1.0.0"}