diff --git a/README.md b/README.md
index 3ff0855..32f35d7 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,51 @@
 # workforce-api
 
-Placeholder component repo for the **workforce** slice of
-`classic-models-api` (see /Users/stephanetailland/git/classic-models-api),
-split out per the DDD decomposition documented in
-`../kong-konnect-deployment-strategy.md`.
+Kong routing/policy layer for the **workforce** slice of
+`classic-models-api` (see `/Users/stephanetailland/git/classic-models-api`),
+split out per the DDD decomposition in `../kong-konnect-deployment-strategy.md`.
+The backend stays a single monolith — only Kong does the domain split.
+Structure mirrors `../sales-api`/`../payments-api` — single MCP route from
+the start, not `../catalog-api`'s original two-route pattern (see
+`../STATUS.md` section 18).
 
-This repo does not yet contain migrated application code — only the
-routing scaffold (layer 3: `HTTPRoute`/`KongPlugin`/`KongConsumer`,
-alongside the eventual app manifests), targeting the Control Plane(s)
-provisioned for `workforce` (see `../konnect-platform/domains/workforce/`
-and `../dataplane-workforce`).
+Two resources, both with a REST surface and MCP tools:
+- **`Office`** (single key `officecode`) — full CRUD + an `employees`
+  sub-resource.
+- **`Employee`** (single key `employeenumber`) — full CRUD + `reports`
+  (direct reports, self-referential FK) and `customers` (assigned sales
+  rep's customers) sub-resources.
+
+| Route | Method | Backend path |
+|---|---|---|
+| `/workforce/v1/offices/` | GET, POST | `/classic-models/api/v1/offices/` |
+| `/workforce/v1/offices/{officecode}/` | GET, PUT, PATCH, DELETE | `/classic-models/api/v1/offices/{officecode}/` |
+| `/workforce/v1/offices/{officecode}/employees/` | GET | `/classic-models/api/v1/offices/{officecode}/employees/` |
+| `/workforce/v1/employees/` | GET, POST | `/classic-models/api/v1/employees/` |
+| `/workforce/v1/employees/{employeenumber}/` | GET, PUT, PATCH, DELETE | `/classic-models/api/v1/employees/{employeenumber}/` |
+| `/workforce/v1/employees/{employeenumber}/reports/` | GET | `/classic-models/api/v1/employees/{employeenumber}/reports/` |
+| `/workforce/v1/employees/{employeenumber}/customers/` | GET | `/classic-models/api/v1/employees/{employeenumber}/customers/` |
+| `/workforce-mcp` | GET, POST, DELETE | MCP streamable-http |
+
+## Auth & MCP tool ACLs — the one domain where `customer` gets zero access
+
+Both viewsets use `ReferenceDataPermission`
+(`authentication/permissions.py`): `read_only`/`product_manager`/`support`
+get read access, writes are **admin-only**, and — unlike every other
+domain built this session — **`customer` is not in the allow-list at
+all**, not even for reads. Verified directly against the permission
+class, not assumed: this is genuinely internal staff/organizational data,
+and the backend enforces that explicitly. All 7 read tools
+(`list-offices`, `get-office`, `get-office-employees`, `list-employees`,
+`get-employee`, `get-employee-reports`, `get-employee-customers`) have ACL
+`[admin, read_only, product_manager, support]` — no `customer`. Both write
+tools (`create-office`, `create-employee`) are `admin` only.
+
+`openid-connect` on both surfaces (`workforce-api` REST audience,
+`mcp-workforce` MCP audience), RFC 8693 exchange chain
+MCP → `workforce-api` → `classic-models-api`. IdP: local Keycloak.
+
+## Structure
+
+Same `dev/` + `kong/rest/` + `kong/mcp/` layout as `sales-api`. Deploy key
+and broker secret reused/mirrored from `catalog-api` and the live broker
+client, same pattern as every domain since `payments-api`.
diff --git a/dev/externalsecret.yaml b/dev/externalsecret.yaml
new file mode 100644
index 0000000..12af889
--- /dev/null
+++ b/dev/externalsecret.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: workforce-api-git-auth
+  namespace: workforce
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: workforce-api-git-auth
+  data:
+    - secretKey: identity
+      remoteRef:
+        key: kong-v2/workforce-api/git-deploy-key
+        property: identity
+    - secretKey: identity.pub
+      remoteRef:
+        key: kong-v2/workforce-api/git-deploy-key
+        property: identity.pub
+    - secretKey: known_hosts
+      remoteRef:
+        key: kong-v2/workforce-api/git-deploy-key
+        property: known_hosts
diff --git a/dev/flux-kustomization.yaml b/dev/flux-kustomization.yaml
new file mode 100644
index 0000000..2338d0c
--- /dev/null
+++ b/dev/flux-kustomization.yaml
@@ -0,0 +1,32 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: workforce-dev-api
+  namespace: workforce
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: workforce-api-dev
+  path: ./kong
+  prune: true
+  dependsOn:
+    - name: workforce-dev-api-gateway
+      namespace: flux-system
+  postBuild:
+    substitute:
+      NAME: workforce-dev
+      NAMESPACE: workforce
+      CONTROL_PLANE_REF_NAME: workforce-dev-6cq27
+      BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
+      API_AUDIENCE: '["workforce-api"]'
+      BACKEND_AUDIENCE: '["classic-models-api"]'
+      BACKEND_SCOPES: '[]'
+      API_RATE_LIMIT_MINUTE: "60"
+      AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs
+      REST_HOSTNAME: workforce-dev.sttlab.local
+      TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker
+    substituteFrom:
+      - kind: Secret
+        name: workforce-token-exchange-broker
diff --git a/dev/gitrepository.yaml b/dev/gitrepository.yaml
new file mode 100644
index 0000000..45b6af7
--- /dev/null
+++ b/dev/gitrepository.yaml
@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: workforce-api-dev
+  namespace: workforce
+spec:
+  interval: 5m
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-workforce-api.git
+  secretRef:
+    name: workforce-api-git-auth
+  ref:
+    branch: main
diff --git a/dev/token-exchange-broker-externalsecret.yaml b/dev/token-exchange-broker-externalsecret.yaml
new file mode 100644
index 0000000..c98c65f
--- /dev/null
+++ b/dev/token-exchange-broker-externalsecret.yaml
@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: workforce-token-exchange-broker
+  namespace: workforce
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: workforce-token-exchange-broker
+  data:
+    - secretKey: TOKEN_EXCHANGE_CLIENT_SECRET
+      remoteRef:
+        key: kong-v2/workforce-api/token-exchange-broker
+        property: client_secret
diff --git a/kong/httproute.yaml b/kong/httproute.yaml
deleted file mode 100644
index 90f483e..0000000
--- a/kong/httproute.yaml
+++ /dev/null
@@ -1 +0,0 @@
-# TODO: HTTPRoute for workforce's resources
diff --git a/kong/kongplugin.yaml b/kong/kongplugin.yaml
deleted file mode 100644
index 6b6136b..0000000
--- a/kong/kongplugin.yaml
+++ /dev/null
@@ -1 +0,0 @@
-# TODO: KongPlugin(s) specific to workforce
diff --git a/kong/kustomization.yaml b/kong/kustomization.yaml
new file mode 100644
index 0000000..afc03db
--- /dev/null
+++ b/kong/kustomization.yaml
@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rest/service.yaml
+  - rest/routes.yaml
+  - rest/path-rewrite.yaml
+  - rest/path-rewrite-bindings.yaml
+  - rest/kongplugin.yaml
+  - rest/rate-limiting.yaml
+  - rest/proxy-cache.yaml
+  - rest/audit-log.yaml
+  - rest/audit-log-body-capture.yaml
+  - rest/audit-log-body-capture-bindings.yaml
+  - rest/pluginbindings.yaml
+  - mcp/service.yaml
+  - mcp/routes.yaml
+  - mcp/consumergroups.yaml
+  - mcp/ai-mcp-proxy.yaml
+  - mcp/openid-connect.yaml
+  - mcp/audit-log.yaml
+  - mcp/audit-log-body-capture.yaml
+  - mcp/audit-log-body-capture-bindings.yaml
+  - mcp/pluginbindings.yaml
diff --git a/kong/mcp/ai-mcp-proxy.yaml b/kong/mcp/ai-mcp-proxy.yaml
new file mode 100644
index 0000000..4175726
--- /dev/null
+++ b/kong/mcp/ai-mcp-proxy.yaml
@@ -0,0 +1,267 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-mcp-ai-mcp-proxy
+  namespace: ${NAMESPACE}
+plugin: ai-mcp-proxy
+config:
+  mode: conversion-listener
+  include_consumer_groups: true
+  tools:
+    - name: list-offices
+      description: Retrieves a paginated list of offices in the classic-models organization.
+      annotations:
+        title: List all offices
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      # Verified against ReferenceDataPermission.check() — read_only,
+      # product_manager, support pass for SAFE_METHODS; customer has NO
+      # access at all (not in the allow-list, unlike every other domain
+      # built this session). Not guessed — this domain is internal staff
+      # data, the backend enforces that explicitly.
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/offices/
+    - name: get-office
+      description: Retrieves a single office by office code.
+      annotations:
+        title: Get an office
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/offices/{officecode}/
+      parameters:
+        - name: officecode
+          in: path
+          required: true
+          description: The office's unique code.
+          schema: {}
+    - name: get-office-employees
+      description: Retrieves all employees working in a specific office.
+      annotations:
+        title: Get office employees
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/offices/{officecode}/employees/
+      parameters:
+        - name: officecode
+          in: path
+          required: true
+          description: The office's unique code.
+          schema: {}
+    - name: create-office
+      description: Creates a new office in the organization.
+      annotations:
+        title: Create an office
+        read_only_hint: false
+        idempotent_hint: false
+        destructive_hint: false
+        open_world_hint: false
+      # Writes are admin-only under ReferenceDataPermission (check()
+      # returns False for non-admin on any non-SAFE method).
+      acl:
+        allow:
+          - admin
+      method: POST
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/offices/
+      request_body:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                officecode:
+                  type: string
+                city:
+                  type: string
+                phone:
+                  type: string
+                addressline1:
+                  type: string
+                addressline2:
+                  type: string
+                state:
+                  type: string
+                country:
+                  type: string
+                postalcode:
+                  type: string
+                territory:
+                  type: string
+              required:
+                - officecode
+                - city
+                - phone
+                - addressline1
+                - country
+                - postalcode
+                - territory
+    - name: list-employees
+      description: Retrieves a paginated list of employees in the classic-models organization.
+      annotations:
+        title: List all employees
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/employees/
+    - name: get-employee
+      description: Retrieves a single employee by employee number.
+      annotations:
+        title: Get an employee
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/employees/{employeenumber}/
+      parameters:
+        - name: employeenumber
+          in: path
+          required: true
+          description: The employee's unique number.
+          schema: {}
+    - name: get-employee-reports
+      description: Retrieves all employees reporting to a specific manager.
+      annotations:
+        title: Get employee reports
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/employees/{employeenumber}/reports/
+      parameters:
+        - name: employeenumber
+          in: path
+          required: true
+          description: The manager's employee number.
+          schema: {}
+    - name: get-employee-customers
+      description: Retrieves all customers assigned to a specific sales representative.
+      annotations:
+        title: Get employee's customers
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/employees/{employeenumber}/customers/
+      parameters:
+        - name: employeenumber
+          in: path
+          required: true
+          description: The sales rep's employee number.
+          schema: {}
+    - name: create-employee
+      description: Adds a new employee to the organization.
+      annotations:
+        title: Create an employee
+        read_only_hint: false
+        idempotent_hint: false
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+      method: POST
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /workforce/v1/employees/
+      request_body:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                employeenumber:
+                  type: integer
+                lastname:
+                  type: string
+                firstname:
+                  type: string
+                extension:
+                  type: string
+                email:
+                  type: string
+                officecode:
+                  type: string
+                reportsto:
+                  type: integer
+                jobtitle:
+                  type: string
+              required:
+                - employeenumber
+                - lastname
+                - firstname
+                - extension
+                - email
+                - officecode
+                - jobtitle
diff --git a/kong/mcp/audit-log-body-capture-bindings.yaml b/kong/mcp/audit-log-body-capture-bindings.yaml
new file mode 100644
index 0000000..beda1b2
--- /dev/null
+++ b/kong/mcp/audit-log-body-capture-bindings.yaml
@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-mcp-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-mcp-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-mcp-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-mcp-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-mcp
diff --git a/kong/mcp/audit-log-body-capture.yaml b/kong/mcp/audit-log-body-capture.yaml
new file mode 100644
index 0000000..40cc690
--- /dev/null
+++ b/kong/mcp/audit-log-body-capture.yaml
@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-mcp-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-mcp-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end
diff --git a/kong/mcp/audit-log.yaml b/kong/mcp/audit-log.yaml
new file mode 100644
index 0000000..17f43e3
--- /dev/null
+++ b/kong/mcp/audit-log.yaml
@@ -0,0 +1,13 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-mcp-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"
diff --git a/kong/mcp/consumergroups.yaml b/kong/mcp/consumergroups.yaml
new file mode 100644
index 0000000..b18fe72
--- /dev/null
+++ b/kong/mcp/consumergroups.yaml
@@ -0,0 +1,59 @@
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-admin
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: admin
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-read-only
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: read_only
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-product-manager
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: product_manager
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-customer
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: customer
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-support
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: support
diff --git a/kong/mcp/openid-connect.yaml b/kong/mcp/openid-connect.yaml
new file mode 100644
index 0000000..e91916f
--- /dev/null
+++ b/kong/mcp/openid-connect.yaml
@@ -0,0 +1,27 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-mcp-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${API_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_groups_claim:
+    - realm_access
+    - roles
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${API_AUDIENCE}
+      scopes: []
diff --git a/kong/mcp/pluginbindings.yaml b/kong/mcp/pluginbindings.yaml
new file mode 100644
index 0000000..14b493c
--- /dev/null
+++ b/kong/mcp/pluginbindings.yaml
@@ -0,0 +1,53 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-mcp-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-mcp-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-mcp-ai-mcp-proxy-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-mcp-ai-mcp-proxy
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-mcp-audit-log-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-mcp-audit-log
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-mcp
diff --git a/kong/mcp/routes.yaml b/kong/mcp/routes.yaml
new file mode 100644
index 0000000..d1734d9
--- /dev/null
+++ b/kong/mcp/routes.yaml
@@ -0,0 +1,22 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-mcp
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-mcp
+  name: workforce-mcp
+  hosts:
+    - ${REST_HOSTNAME}
+  methods:
+    - GET
+    - POST
+    - DELETE
+  paths:
+    - /workforce-mcp
+  strip_path: false
+  tags:
+    - workforce
diff --git a/kong/mcp/service.yaml b/kong/mcp/service.yaml
new file mode 100644
index 0000000..da22cd2
--- /dev/null
+++ b/kong/mcp/service.yaml
@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-workforce-mcp
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: workforce-mcp
+  host: ${REST_HOSTNAME}
+  port: 80
+  protocol: http
+  path: /
+  tags:
+    - workforce
diff --git a/kong/rest/audit-log-body-capture-bindings.yaml b/kong/rest/audit-log-body-capture-bindings.yaml
new file mode 100644
index 0000000..cdb9227
--- /dev/null
+++ b/kong/rest/audit-log-body-capture-bindings.yaml
@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
diff --git a/kong/rest/audit-log-body-capture.yaml b/kong/rest/audit-log-body-capture.yaml
new file mode 100644
index 0000000..6367396
--- /dev/null
+++ b/kong/rest/audit-log-body-capture.yaml
@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end
diff --git a/kong/rest/audit-log.yaml b/kong/rest/audit-log.yaml
new file mode 100644
index 0000000..15a2d31
--- /dev/null
+++ b/kong/rest/audit-log.yaml
@@ -0,0 +1,13 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"
diff --git a/kong/rest/kongplugin.yaml b/kong/rest/kongplugin.yaml
new file mode 100644
index 0000000..56a8434
--- /dev/null
+++ b/kong/rest/kongplugin.yaml
@@ -0,0 +1,30 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${BACKEND_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_claims:
+    - - sub
+  consumer_by:
+    - custom_id
+    - username
+  consumer_optional: true
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${BACKEND_AUDIENCE}
+      scopes: ${BACKEND_SCOPES}
diff --git a/kong/rest/path-rewrite-bindings.yaml b/kong/rest/path-rewrite-bindings.yaml
new file mode 100644
index 0000000..941fd6c
--- /dev/null
+++ b/kong/rest/path-rewrite-bindings.yaml
@@ -0,0 +1,269 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listoffices-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-listoffices
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-listoffices
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-createoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-createoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-updateoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-updateoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-patchoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-patchoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-deleteoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-deleteoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getofficeemployees-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getofficeemployees
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getofficeemployees
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listemployees-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-listemployees
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-listemployees
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-createemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-createemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-updateemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-updateemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-patchemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-patchemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-deleteemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-deleteemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeereports-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getemployeereports
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getemployeereports
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeecustomers-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getemployeecustomers
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getemployeecustomers
diff --git a/kong/rest/path-rewrite.yaml b/kong/rest/path-rewrite.yaml
new file mode 100644
index 0000000..44105fc
--- /dev/null
+++ b/kong/rest/path-rewrite.yaml
@@ -0,0 +1,149 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listoffices
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getofficeemployees
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/employees/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listemployees
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeereports
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/reports/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeecustomers
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/customers/
diff --git a/kong/rest/pluginbindings.yaml b/kong/rest/pluginbindings.yaml
new file mode 100644
index 0000000..e7748a8
--- /dev/null
+++ b/kong/rest/pluginbindings.yaml
@@ -0,0 +1,71 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rate-limiting-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rate-limiting
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-proxy-cache-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-proxy-cache
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-audit-log-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-audit-log
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
diff --git a/kong/rest/proxy-cache.yaml b/kong/rest/proxy-cache.yaml
new file mode 100644
index 0000000..eedf6d9
--- /dev/null
+++ b/kong/rest/proxy-cache.yaml
@@ -0,0 +1,16 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-proxy-cache
+  namespace: ${NAMESPACE}
+plugin: proxy-cache-advanced
+config:
+  strategy: memory
+  request_method:
+    - GET
+    - HEAD
+  response_code:
+    - 200
+  content_type:
+    - application/json
+  cache_ttl: 60
diff --git a/kong/rest/rate-limiting.yaml b/kong/rest/rate-limiting.yaml
new file mode 100644
index 0000000..13cb428
--- /dev/null
+++ b/kong/rest/rate-limiting.yaml
@@ -0,0 +1,14 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rate-limiting
+  namespace: ${NAMESPACE}
+plugin: rate-limiting-advanced
+config:
+  limit:
+    - ${API_RATE_LIMIT_MINUTE}
+  window_size:
+    - 60
+  identifier: consumer
+  sync_rate: -1
+  strategy: local
diff --git a/kong/rest/routes.yaml b/kong/rest/routes.yaml
new file mode 100644
index 0000000..bbb6ea2
--- /dev/null
+++ b/kong/rest/routes.yaml
@@ -0,0 +1,299 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-listoffices
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_listoffices
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /workforce/v1/offices/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-createoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_createoffice
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /workforce/v1/offices/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getoffice
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-updateoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_updateoffice
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-patchoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_patchoffice
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-deleteoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_deleteoffice
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getofficeemployees
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getofficeemployees
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/employees/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-listemployees
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_listemployees
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /workforce/v1/employees/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-createemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_createemployee
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /workforce/v1/employees/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getemployee
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-updateemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_updateemployee
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-patchemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_patchemployee
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-deleteemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_deleteemployee
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getemployeereports
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getemployeereports
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/reports/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getemployeecustomers
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getemployeecustomers
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/customers/$
+  strip_path: false
+  tags:
+    - workforce
diff --git a/kong/rest/service.yaml b/kong/rest/service.yaml
new file mode 100644
index 0000000..99557b3
--- /dev/null
+++ b/kong/rest/service.yaml
@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-workforce-api
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: workforce-api
+  host: ${BACKEND_HOST}
+  port: 8000
+  protocol: http
+  path: /
+  tags:
+    - workforce