Skip to content

MuleSoft AI Gateway metering

MuleSoft AI Gateway and Agent Fabric supply centralized token-metering rows for AI inference traffic routed through MuleSoft.

Onboarding scope

This guide covers the read-only mulesoft connector in the Venturi platform connector package. It reads gateway metering and inventory and never deploys APIs, changes policies, or administers gateways.

Required access

The names below are Venturi capability identifiers, not Anypoint scopes:

Venturi capability Purpose
AnypointPlatform.Read Read Anypoint platform context.
AIGateway.Metering.Read Read AI Gateway token metering rows.
AgentFabric.Read Read Agent Fabric context.

Do not grant API deployment, policy mutation, or gateway administration scopes.

The vendor-side authorization is an Anypoint connected app created with the App acts on its own behalf (client credentials) option. Anypoint connected-app scopes map to Anypoint Platform permissions, so add only these view scopes:

Anypoint scope What it reads Where to apply it
API Manager: View APIs Configuration API and model proxy inventory, and AI Gateway instances. Each environment that hosts AI Gateway or Agent Fabric instances.
Anypoint Monitoring: Monitoring Viewer AI Gateway token and request metrics, and monitoring data for agentic assets. The business group that owns those instances.
Exchange: Exchange Viewer Agent Fabric agents and other agentic assets. The same business group.
Usage: Usage Viewer Token Usage reports for model proxies, by business group or application. The root organization. Only an organization administrator can add it there.

Do not add scopes that manage APIs, policies, contracts, or client applications. See MuleSoft’s connected-app creation guide, permissions by product, and token usage reports. In Access Management → Connected Apps, the Scopes Documentation tab shows each scope’s permissions. The connector never submits the Venturi capability names above as OAuth scopes.

Setup

  1. Create a dedicated Anypoint connected app for Venturi that acts on its own behalf.
  2. Add only the four view scopes above, each applied at the business group, environment, or root organization level the table names.
  3. Store the client secret as an encrypted credential reference in Settings / Admin / Credentials.
  4. The default lookback is 30 days; set VENTURI_MULESOFT_LOOKBACK_DAYS to change it. See sync windows and failure behavior.
  5. In Venturi, go to Integrations / MuleSoft AI Gateway and run Test connection.

Verification

  • Test connection passes the read-only boundary check: metering and inventory reads succeed, and the connected app holds only the four view scopes above, with no API deployment or policy-write scope.
  • Gateway metering rows appear for the expected gateway identifiers.
  • Token counts are normalized with source mulesoft_ai_gateway_metering_api.
  • The connector inventory marks MuleSoft AI Gateway as read-only.

Rotation and offboarding

Rotate the connected app’s client secret through Anypoint Access Management, then update the credential reference in Settings / Admin / Credentials. Removing the connector stops new MuleSoft AI Gateway metering syncs.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: MuleSoft AI Gateway metering
Page: https://docs.venturi.systems/connectors/mulesoft/