# InterceptorOptions

Options for configuring an interceptor.

- Source: [`aws-bedrockagentcore/lib/gateway/interceptor.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/interceptor.ts#L32)
- Type last changed: v2.255.0 · 19 May 2026

## Example

```ts
// Create Lambda functions for interceptors
const requestInterceptorFn = new lambda.Function(this, "RequestInterceptor", {
  runtime: lambda.Runtime.PYTHON_3_12,
  handler: "index.handler",
  code: lambda.Code.fromInline(`
def handler(event, context):
    # Validate and transform request
    return {
        "interceptorOutputVersion": "1.0",
        "mcp": {
            "transformedGatewayRequest": event["mcp"]["gatewayRequest"]
        }
    }
  `),
});

const responseInterceptorFn = new lambda.Function(this, "ResponseInterceptor", {
  runtime: lambda.Runtime.PYTHON_3_12,
  handler: "index.handler",
  code: lambda.Code.fromInline(`
def handler(event, context):
    # Filter or transform response
    return {
        "interceptorOutputVersion": "1.0",
        "mcp": {
            "transformedGatewayResponse": event["mcp"]["gatewayResponse"]
        }
    }
  `),
});

// Create gateway with interceptors
const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  interceptorConfigurations: [
    agentcore.LambdaInterceptor.forRequest(requestInterceptorFn, {
      passRequestHeaders: true  // Only if you need to inspect headers
    }),
    agentcore.LambdaInterceptor.forResponse(responseInterceptorFn)
  ]
});
```

## Properties

- `passRequestHeaders`: boolean — Whether to pass request headers to the interceptor Lambda function.

  **Default:** false - Headers are not passed to interceptor for security

  **Security Warning**: Request headers can contain sensitive information such as
  authentication tokens and credentials. Only enable this if your interceptor needs
  access to headers and you have verified that sensitive information is not logged
  or exposed.