> This page is for Itential Platform On-Prem, version 6 (default).
> For other versions, use one of these documentation indexes:
> - 6 (default): https://docs-test.itntl.com/itential-platform/6/llms.txt
> - 2023.2: https://docs-test.itntl.com/itential-platform/2023-2/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs-test.itntl.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs-test.itntl.com/_mcp/server.

# Gateway configuration

> Configure the Platform default gateway cluster, integration-level execution and proxy settings, and Run Code task cluster restrictions in Admin Essentials.

Platform 6.4.0+

Use **Gateway Configuration** in Admin Essentials to configure how Platform features execute through your customer-hosted Itential Gateway 5 deployment. Outbound API calls and `runCode` task execution originate from your Gateway 5 environment rather than from Itential's cloud, so they pass through your existing network controls.

If your network requires outbound traffic to pass through a

proxy server

, you can configure it here once and all integrations inherit it by default.

## Before you begin

At least one gateway cluster running Gateway version 5.4 or later must be registered in Gateway Manager. For information, see [Gateway Manager overview](/itential-gateway/gateway-manager-overview) and [Create a gateway cluster](/itential-gateway/create-gateway-cluster).

## Set the Platform default cluster

Use the **Platform Default** section to designate the default gateway cluster that all Gateway 5-dependent features inherit when no feature-specific cluster is set.

> **Warning**
>
> Setting the Platform default cluster does not guarantee availability. If the cluster configured for a specific feature becomes unavailable, Platform returns an error — it does not fall back to the default.

To set the Platform default cluster:

In Admin Essentials, go to **Gateway Configuration**.

In the **Platform Default** section, select a **Default Cluster** from clusters registered in Gateway Manager.

Click **Save**.

Some considerations:

* If the designated cluster is disconnected or becomes unavailable after you save, Gateway 5-dependent features become inaccessible and you must reconfigure this setting.

## Configure integration settings

**Feature-Specific Execution Defaults** lets you choose a different gateway cluster for a specific feature, such as integrations, and configure additional settings for it. These settings apply to all integrations by default. Individual integrations can override the cluster and proxy settings configured here. For more information, see [Manage integrations](/itential-platform/admin-essentials/integrations/manage).

### Override the cluster for integration

By default, integrations use the Platform default cluster. To route integrations through a different cluster:

Under **Integrations**, select a cluster from the **Default cluster** dropdown.

Click **Save**. Integrations use this cluster instead of the Platform default.

### Select a default execution mode

The **Default Execution Mode** setting controls how integration requests are routed. Each integration can override this setting from its own configuration page.

#### Select an execution mode

Under **Integrations**, select one of the following from the **Default Execution Mode** dropdown:

| Execution mode                 | Description                                                                                                                                                            |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Direct connection**          | Requests are executed from Platform without a cluster or proxy server. Use this for internal services that don't require gateway routing.                              |
| **Default cluster, no proxy**  | Requests are executed from the feature-level default cluster without a proxy server. Use this when gateway execution is required but your network doesn't use a proxy. |
| **Default cluster with proxy** | Requests are executed from the feature-level default cluster and an outbound proxy server. Selecting this mode reveals proxy configuration fields.                     |

#### Configure proxy settings (Default cluster with proxy only)

If you selected **Default cluster with proxy**, configure the following fields:

> **Note**
>
> Platform supports HTTPS proxies only.

| Field                         | Description                                                                                                                       |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Hostname or IP address**    | The hostname or IP address of the proxy server.                                                                                   |
| **Port**                      | The port used to connect to the proxy server.                                                                                     |
| **Proxy authentication type** | The authentication method for the proxy server. Options: **No authentication**, **Basic authentication**, or **Secrets manager**. |

For **Proxy authentication type**, configure one of the following:

* **Basic authentication**: Enter a username and password.
* **Secrets manager**: Enter the keys used to look up the proxy credentials. Platform retrieves the credentials at runtime. For supported systems and setup, see [Secrets management overview](/itential-platform/secrets/overview).

#### Save

Click **Save**. Changes take effect immediately, without a Platform restart.

## Restrict runCode task execution to designated clusters

Platform 6.6.0+

The **Run Code Task** section under **Feature-Specific Execution Defaults** lets you restrict [`runCode` task](/itential-platform/studio/tasks/reference/run-code) execution to one or more approved gateway clusters. Use this to keep Python code execution off clusters with competing workloads or security risk.

> **Warning**
>
> This setting is a restriction, not a default. Unlike the **Integrations** override pattern, no one can select a cluster outside the approved set once you configure this setting—every `runCode` task must use an approved cluster. There's no separate toggle: selecting a **Default Cluster** activates the restriction immediately.

To restrict `runCode` task execution:

In Admin Essentials, go to **Gateway Configuration**.

Under **Feature-Specific Execution Defaults**, expand **Run Code Task**.

Select a **Default Cluster** from clusters registered in Gateway Manager. Platform uses this cluster automatically for new `runCode` tasks, but not for existing tasks whose assigned cluster is no longer approved—those require manual correction. See [Effect on runCode task configuration](#effect-on-runcode-task-configuration) and [Find workflows that use a gateway cluster](#find-workflows-that-use-a-gateway-cluster).

Optional: Click **+ Add Cluster** to designate additional **Allowed Cluster** entries. Any cluster in the combined list of the Default Cluster and Allowed Clusters is available for `runCode` tasks.

Click **Save Changes**.

### Effect on runCode task configuration

Once a restriction is active, the cluster field on a `runCode` task remains a dropdown, but the list of options is limited to the approved clusters—even if you approve only one cluster, the field still shows as a dropdown, filtered to that single option.

The field also displays the following note:

> **Note**
>
> Your administrator has restricted Run Code Task execution to designated cluster(s).

For the `runCode` task configuration experience, see [Cluster restrictions](/itential-platform/studio/tasks/reference/run-code#cluster-restrictions) in the `runCode` task reference.

### Find workflows that use a gateway cluster

Before you remove a cluster from the approved list, check whether any `runCode` tasks still target it, so you can update those workflows ahead of time instead of waiting for them to fail at run time.

In Gateway Manager, go to **Gateways** and open the cluster you're planning to remove.

Select the **Workflows** tab. This lists every workflow with a task that targets the cluster.

Filter the **Task** column for `runCode` to narrow the list to Run Code tasks.

Update any listed workflow to use an approved cluster before you remove this cluster from the approved list.

Once you remove the cluster and repeat this check, no workflows should appear for `runCode` in the filtered list.