Prerequisites

Before jumping into the steps, you’ll need a few things set up:

• [Docker](https://docs.docker.com/get-docker/)Docker installed locally
• [decK](https://docs.konghq.com/deck/latest/installation/)decK installed (Kong’s declarative configuration tool)
• A [Solace Cloud](https://console.solace.cloud/)Solace Cloud instance (recommended) or a local Solace Broker running in Docker

Note: We’ll use the example repo [kong-api-gw-examples](https://github.com/hguerrero/kong-api-gw-examples)kong-api-gw-examples which includes a prebuilt configuration for Kong.

Step 1 – Clone the Repository

Grab the example setup from GitHub and navigate into the project directory:

git clone https://github.com/hguerrero/kong-api-gw-examples.git
cd kong-api-gw-examples/solace-http-mediation

Step 2 – Start Kong

If you’re running Solace locally, start everything with:

docker compose up -d

This will launch Kong Gateway and a local Solace broker.

👉 If you’re using Solace Cloud, you don’t need the broker container. Just bring up Kong:

docker compose up -d kong

Make sure you grab your Solace Cloud connection details (host, message VPN, username, password) from the Solace Cloud Console.

Step 3 – Configure Solace Cloud

Log into the Solace Cloud Console, create a Queue (e.g. kongDemoQueue), and subscribe it to a topic ( orders/new). You can follow the instructions [here](https://solace.com/blog/create-message-queue-in-solace/)here.

Step 4 – Configure Kong with decK

We’ll load Kong’s configuration using decK. The repository includes a kong.yaml file that defines a service pointing to your Solace broker, a /solace route, and the Solace upstream plugin.

Update the kong.yaml file with your Solace connection details. Here is what the configuration looks like:

_format_version: "3.0"

vaults:
  - name: konnect
    description: Secrets from Konnect
    prefix: kv
    config:
      config_store_id: <your_config_store_id>

services:
  - name: solace-cloud-service
    url: "http://{{SOLACE_HOST}}:{{SOLACE_PORT_HTTP}}"
    routes:
      - name: solace-incoming-orders-route
        paths:
          - ~/solace/(?<topic_id>[\w/-]+)
        methods:
          - POST
      - name: solace-outcoming-orders-route
        paths:
          - ~/solace/(?<topic_id>[\w-]+)
        methods:
          - GET

plugins:
  # Solace integration
  - name: solace-upstream
    route: solace-incoming-orders-route
    config:
      session:
        host: tcp://solace:55555
        vpn_name: demo
        authentication:
          scheme: BASIC
          username: "{vault://kv/solace-username}"
          password: "{vault://kv/solace-password}"
      message:
        destinations:
          - name: $(uri_captures['topic_id'])
            type: TOPIC
        delivery_mode: DIRECT
        forward_body: true
        functions:
          - return message.body
  - name: solace-consume
    route: solace-outcoming-orders-route
    config:
      mode: WEBSOCKET
      session:
        host: tcp://solace:55555
        vpn_name: demo
        authentication:
          scheme: BASIC
          username: "{vault://kv/solace-username}"
          password: "{vault://kv/solace-password}"
      flow:
        binds:
        - name: $(uri_captures['topic_id'])

  # Security
  - name: key-auth
    service: solace-cloud-service
    config:
      anonymous: anonymous
      hide_credentials: true
      key_names:
        - apikey
  - name: jwt
    service: solace-cloud-service
    config:
      anonymous: anonymous
      header_names:
        - authorization
      claims_to_verify:
        - exp
        - nbf
  - name: acl
    route: solace-incoming-orders-route
    config:
      allow:
        - solace
        - admin
      hide_groups_header: true
  - name: acl
    service: solace-cloud-service
    config:
      deny:
        - anonymous
      hide_groups_header: true

  # Validation
  - name: request-validator
    route: solace-incoming-orders-route
    config:
      version: draft4
      body_schema: |
        {
          "type":"object",
          "required":["orderId","customerId","items","total"],
          "properties":{
            "orderId":{"type":"string"},
            "customerId":{"type":"string"},
            "items":{"type":"array"},
            "total":{"type":"number"}
          }
        }

  # Transformation & Enrichment
  - name: request-transformer
    config:
      add:
        headers:
        - "x-topic: orders/new"
  - name: pre-function
    config:
      access: |
        return function()
          local cid = kong.request.get_header("x-correlation-id")
          if not cid then
            cid = tostring(ngx.now() * 1000000)
            kong.service.request.set_header("x-correlation-id", cid)
          end
        end

  # Protection
  - name: rate-limiting
    config:
      policy: local
      minute: 5
  - name: request-size-limiting
    config:
      allowed_payload_size: 8192
      size_unit: bytes

  # Global Observability
  - name: prometheus
    config: {}
  - name: opentelemetry
    config:
      service_name: "kong-solace-demo"

consumers:
  - username: anonymous
    acls:
      - group: anonymous
  - username: partner@example.com
    keyauth_credentials:
      - key: partner1234
  - username: internal@example.com
    acls:
      - group: solace
    keyauth_credentials:
      - key: internal1234
    jwt_secrets:
      - algorithm: HS256
        key: <your_key>
        secret: <your_secret>

# Global observability (Optional)
- name: prometheus
  config: {}
- name: opentelemetry
  config:
    service_name: "kong-solace-demo"

Then, apply the configuration to Kong:

deck sync --kong-addr http://localhost:8001

Kong is now ready to mediate between HTTP requests and Solace events!

Step 5 – Test the Flow

Now it's time to see it in action:

1. Publish an order: Send a REST request with a valid JWT/API key. Watch as Kong validates, enriches, and forwards the data to Solace.
2. Subscribe in Solace Manager:
   1. Open the [Try Me](https://docs.solace.com/Cloud/ggs_tryme.htm)Try Me! Tab.
   2. Connect a subscriber and subscribe to orders/new.
   3. Watch the full JSON payload (with x-correlation-id) arrive in real time.
3. Play with the policies:
   1. Send a malformed order (missing items) → Kong rejects it with 400.
   2. Flood requests → Kong enforces rate limits (429).
   3. Try without auth → Kong blocks unauthorized traffic.

This demonstrates Kong’s mediation: developers can interact with Solace topics through a standard API front door, while Solace subscribers consume events as usual.