Build workforce-api REST + MCP layers (Layer 3), full build in one pass

16 routes: Office (single key, full CRUD + employees sub-resource)
and Employee (single key, full CRUD + reports + customers
sub-resources). MCP layer built with the single-route pattern from
the start.

Only domain where customer role has zero access — verified against
ReferenceDataPermission.check(): read_only/product_manager/support
get reads, writes are admin-only, customer isn't in the allow-list
at all. All 9 MCP tool ACLs reflect this exactly.

Keycloak (local): workforce-api-audience + mcp-workforce-audience
client scopes, resource clients, broker/librechat attachments.
Deploy key and broker secret reused/mirrored, same pattern as every
domain since payments-api.

kong/rest/audit-log-body-capture-bindings.yaml

@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api

kong/rest/audit-log-body-capture.yaml

@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end

kong/rest/audit-log.yaml

@@ -0,0 +1,13 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"

kong/rest/kongplugin.yaml

@@ -0,0 +1,30 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${BACKEND_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_claims:
+    - - sub
+  consumer_by:
+    - custom_id
+    - username
+  consumer_optional: true
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${BACKEND_AUDIENCE}
+      scopes: ${BACKEND_SCOPES}

kong/rest/path-rewrite-bindings.yaml

@@ -0,0 +1,269 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listoffices-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-listoffices
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-listoffices
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-createoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-createoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-updateoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-updateoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-patchoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-patchoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteoffice-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-deleteoffice
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-deleteoffice
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getofficeemployees-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getofficeemployees
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getofficeemployees
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listemployees-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-listemployees
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-listemployees
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-createemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-createemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-updateemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-updateemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-patchemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-patchemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteemployee-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-deleteemployee
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-deleteemployee
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeereports-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getemployeereports
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getemployeereports
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeecustomers-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rewrite-getemployeecustomers
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-workforce-api-getemployeecustomers

kong/rest/path-rewrite.yaml

@@ -0,0 +1,149 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listoffices
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteoffice
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getofficeemployees
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/offices/$(uri_captures.officecode)/employees/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-listemployees
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-createemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-updateemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-patchemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-deleteemployee
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeereports
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/reports/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rewrite-getemployeecustomers
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/employees/$(uri_captures.employeenumber)/customers/

kong/rest/pluginbindings.yaml

@@ -0,0 +1,71 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-rate-limiting-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-rate-limiting
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-proxy-cache-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-proxy-cache
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-workforce-api-audit-log-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-workforce-api-audit-log
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-workforce-api

kong/rest/proxy-cache.yaml

@@ -0,0 +1,16 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-proxy-cache
+  namespace: ${NAMESPACE}
+plugin: proxy-cache-advanced
+config:
+  strategy: memory
+  request_method:
+    - GET
+    - HEAD
+  response_code:
+    - 200
+  content_type:
+    - application/json
+  cache_ttl: 60

kong/rest/rate-limiting.yaml

@@ -0,0 +1,14 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-api-rate-limiting
+  namespace: ${NAMESPACE}
+plugin: rate-limiting-advanced
+config:
+  limit:
+    - ${API_RATE_LIMIT_MINUTE}
+  window_size:
+    - 60
+  identifier: consumer
+  sync_rate: -1
+  strategy: local

kong/rest/routes.yaml

@@ -0,0 +1,299 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-listoffices
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_listoffices
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /workforce/v1/offices/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-createoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_createoffice
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /workforce/v1/offices/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getoffice
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-updateoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_updateoffice
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-patchoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_patchoffice
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-deleteoffice
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_deleteoffice
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getofficeemployees
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getofficeemployees
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/offices/(?<officecode>[^#?/]+)/employees/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-listemployees
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_listemployees
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /workforce/v1/employees/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-createemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_createemployee
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /workforce/v1/employees/
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getemployee
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-updateemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_updateemployee
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-patchemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_patchemployee
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-deleteemployee
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_deleteemployee
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getemployeereports
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getemployeereports
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/reports/$
+  strip_path: false
+  tags:
+    - workforce
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-workforce-api-getemployeecustomers
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-workforce-api
+  name: workforce-api_getemployeecustomers
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/workforce/v1/employees/(?<employeenumber>[^#?/]+)/customers/$
+  strip_path: false
+  tags:
+    - workforce

kong/rest/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-workforce-api
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: workforce-api
+  host: ${BACKEND_HOST}
+  port: 8000
+  protocol: http
+  path: /
+  tags:
+    - workforce