Kong: a plugin can be attached at four scopes

Global, per Service, per Route or per Consumer. Kong picks the most specific match for each request, so the same plugin can behave differently on two routes of one service.

Code

# global - every request through this Kong node
curl -X POST http://localhost:8001/plugins --data name=correlation-id

# per service
curl -X POST http://localhost:8001/services/billing/plugins \
  --data name=rate-limiting --data config.minute=100

# per route
curl -X POST http://localhost:8001/routes/billing-route/plugins \
  --data name=key-auth

# per consumer
curl -X POST http://localhost:8001/consumers/acme/plugins \
  --data name=rate-limiting --data config.minute=1000

Output

# Precedence, most specific first:
#   Consumer + Route + Service
#   Consumer + Route
#   Consumer + Service
#   Route
#   Service
#   Consumer
#   Global
#
# Only ONE instance of a plugin runs per request. The winner is used whole -
# configurations are never merged across scopes.

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-25