# Private Networking for Lightning Tables in Confluent Cloud If you access a Lightning Table over a private network, query it through an HTTP API or with a Model Context Protocol (MCP) client. You can’t run queries in the Confluent Cloud Console over a private network. To connect, use the associated private endpoint for the API or the Real-Time Context Engine MCP endpoint instead of the public endpoint. #### IMPORTANT Lightning Tables are rolling out to Confluent Cloud accounts in phases. If you don’t see this feature, it’s not available for your account at this time. ## Private networking for the API You can query a Lightning Table through the API by using the following private networking options on AWS: - Private Network Interface (PNI) - Multi-environment PrivateLink Attachment through an ingress PrivateLink Gateway - The original PrivateLink Attachment, which the ingress PrivateLink Gateway replaced For more information about these options, see [Use Private Network Interface on Confluent Cloud](../networking/aws-pni.md#cloud-networking-pni-aws) and [Use AWS PrivateLink for Serverless Products on Confluent Cloud](../networking/aws-platt.md#cloud-networking-privatelink-aws-esku). The following table shows the private API endpoint for each networking option. | Networking option | Endpoint | |---------------------------------|----------------------------------------------------------------------| | PNI | `sql-..aws.accesspoint.glb.confluent.cloud` | | Ingress PrivateLink Gateway | `sql-..aws.accesspoint.glb.confluent.cloud` | | Original PrivateLink Attachment | `sql..aws.private.confluent.cloud` | Replace the following placeholders: - ``: The ID of your access point, without the hyphen. The Cloud Console shows the access point ID on the networking page for your environment. For example, if the access point ID is `ap-abc123xyz`, use `apabc123xyz`. - ``: The AWS region of your cluster, for example `us-west-2`. For example, for an access point with the ID `ap-abc123xyz` in the `us-west-2` region, the endpoint is `sql-apabc123xyz.us-west-2.aws.accesspoint.glb.confluent.cloud`. ## Private networking for MCP An MCP client queries a Lightning Table through the Real-Time Context Engine. For the private networking options and endpoints that MCP supports, see [Private Networking for the Real-Time Context Engine in Confluent Cloud](../ai/real-time-context-engine/private-networking.md#rtce-private-networking). #### WARNING **Cross-environment and cross-network access** Review your private network topology and environment isolation model before you use MCP over a private network. With private networking enabled, Lightning Tables that you query with MCP might be accessible across environments and private network boundaries within your organization. ## Related content - [Lightning Tables in Confluent Cloud](overview.md#lightning-tables-overview) - [Get Started with Lightning Tables in Confluent Cloud](get-started.md#lightning-tables-get-started) - [Manage Lightning Tables in Confluent Cloud](manage.md#lightning-tables-manage) - [Private Networking for the Real-Time Context Engine in Confluent Cloud](../ai/real-time-context-engine/private-networking.md#rtce-private-networking) #### NOTE This website includes content developed at the [Apache Software Foundation](https://www.apache.org/) under the terms of the [Apache License v2](https://www.apache.org/licenses/LICENSE-2.0.html).