diff --git a/src/ZB.MOM.WW.ScadaBridge.Commons/Types/DataConnections/MxGatewayEndpointConfig.cs b/src/ZB.MOM.WW.ScadaBridge.Commons/Types/DataConnections/MxGatewayEndpointConfig.cs
new file mode 100644
index 00000000..f1fdbd29
--- /dev/null
+++ b/src/ZB.MOM.WW.ScadaBridge.Commons/Types/DataConnections/MxGatewayEndpointConfig.cs
@@ -0,0 +1,27 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Types.DataConnections;
+
+/// <summary>
+/// Per-endpoint configuration for an MxGateway data connection. Serialized to the
+/// typed JSON shape stored in <c>DataConnection.PrimaryConfiguration</c> /
+/// <c>BackupConfiguration</c>. Both primary and backup use this same shape — the
+/// backup is simply a second gateway endpoint for failover.
+/// </summary>
+public class MxGatewayEndpointConfig
+{
+    /// <summary>Gateway base URL (e.g. "http://localhost:5000").</summary>
+    public string Endpoint { get; set; } = "http://localhost:5000";
+    /// <summary>API key sent to the gateway as <c>authorization: Bearer &lt;key&gt;</c>.</summary>
+    public string ApiKey { get; set; } = "";
+    /// <summary>MXAccess client registration name. Blank → derive "scadabridge-&lt;connName&gt;" at connect time.</summary>
+    public string ClientName { get; set; } = "";
+    /// <summary>MXAccess user id applied to every write-back. 0 = no user context.</summary>
+    public int WriteUserId { get; set; }
+    /// <summary>Use TLS to a secured gateway.</summary>
+    public bool UseTls { get; set; }
+    /// <summary>Path to the CA certificate (TLS only).</summary>
+    public string CaFile { get; set; } = "";
+    /// <summary>TLS server-name override.</summary>
+    public string ServerName { get; set; } = "";
+    /// <summary>ReadBulk per-call timeout in milliseconds.</summary>
+    public int ReadTimeoutMs { get; set; } = 5000;
+}