Run a full diagnostic on a route
diagnose_routeDiagnose route issues in Kong Gateway by running rule-based checks on configuration, plugins, upstream health, and consumer credentials, returning structured findings.
Instructions
Runs a complete, rule-based diagnostic on one route and returns structured findings.
This is the highest-value tool in this server and usually the right SECOND call, after find_route_by_path. It performs the whole investigation a careful engineer would -- resolve the route, resolve its service, collect plugins at all three scopes, check upstream target health, check the named consumer's credentials and ACL groups, compare against the declared configuration baseline -- and applies the diagnostic rules to the result.
USE WHEN: the user reports a problem with a route or path. Prefer it over assembling the same picture yourself from get_route + list_plugins_for_route + check_upstream_health: it is one call instead of four, and it will not mistake "not collected" for "not present".
Pass consumer whenever the user named a specific client. Without it, consumer-specific
causes are invisible and the diagnosis will look clean when it is not.
RETURNS: confidence CONFIRMED | PARTIAL | INSUFFICIENT_EVIDENCE summary one-sentence verdict findings[] each with code, severity, observedState, expectedState, evidence[], recommendedNextStep observed what Kong actually reports (route, service, effective plugins, consumer, upstream) gaps[] evidence that could not be collected, and what that prevents concluding suggestedNextSteps[]
HOW TO READ IT: every finding is derived from Kong by deterministic rules -- these are facts,
not guesses. Report them as such, and cite the evidence entries. Respect confidence:
PARTIAL means something could not be read and a further problem may be hidden there. Zero
findings with CONFIRMED means the route is genuinely fine; say so rather than inventing a
cause.
LIMITATIONS: inspects gateway configuration and Kong's own health verdicts only. It does not send traffic, read gateway logs, or observe live request behaviour. A backend that returns HTTP 500 on every request looks perfectly healthy here.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | URL path the user named, e.g. "/payments". Use this when the user described a path. | |
| route | No | Route name or `route:<name>` reference, when you already know it. | |
| consumer | No | Consumer username to check credentials and ACL membership for. Supply this whenever the user named a specific client, since consumer-specific causes (missing credential, wrong ACL group) cannot be detected without it. |