# Choose which operations are exposed

An exposed operation is one that clients of an environment can see and call. Every operation starts exposed when you add its API, except recipes and deprecated operations, which start hidden. Hide the ones no client of this environment should reach.

Exposure is set per environment. An operation hidden in Production can stay exposed in Staging.

## Expose or hide operations

To choose the operations an environment serves:

1. In the portal, go to [**Agent Gateway**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fagent-gateway) and select your gateway.
2. Check the environment button in the header.
3. Select the **Operations** tab.
4. Turn the **Exposed** switch off for each operation to hide, or on to expose it again.
   - To find an operation, enter part of its name in **Search operations…** or filter by API.
   - To change many at once, select **Expose all** or **Hide all**. With a search or an API filter active, the links read **Expose matching** and **Hide matching** and apply to the rows shown.
5. Select **Save changes**.

Nothing applies until you save. After you save, a hidden operation is gone from the MCP tool list, from `search_operations`, from the REST mirror and from the OpenAPI document. A call to it returns `unknown_operation`.

![The gateway's Operations tab, with an Exposed switch for each operation of the API.](https://docs.faustine.ai/images/agent-gateway/operations-light.png)

## What you cannot change here

The **Kind** (read or write) and **Confirmation** columns are read-only in this tab. They belong to the API and apply to every gateway that serves it. To change them, select **Open the API page** and edit the operation there. See [Operations](https://docs.faustine.ai/apis/operations/).

## Exposure and scopes

Exposure is the outer limit for the whole environment. A credential's scope selects from the exposed operations and cannot reach a hidden one. To give one key fewer operations than another, leave the operations exposed and narrow the key. See [Scope a key or user](https://docs.faustine.ai/agent-gateway/scope-a-credential/).

## Next steps

- [Scope a key or user](https://docs.faustine.ai/agent-gateway/scope-a-credential/): limit one credential to some of the exposed operations.
- [Confirmation](https://docs.faustine.ai/agent-gateway/confirmation/): keep a write exposed and have a person approve it.
- [Customize the gateway docs page](https://docs.faustine.ai/agent-gateway/docs-page/): leave an operation callable and out of the API reference.