diff --git a/.changelog/16649.txt b/.changelog/16649.txt
new file mode 100644
index 0000000000..e510558ff9
--- /dev/null
+++ b/.changelog/16649.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+gateways: Adds validation to ensure the API Gateway has a listener defined when created
+```
\ No newline at end of file
diff --git a/agent/structs/config_entry_discoverychain_test.go b/agent/structs/config_entry_discoverychain_test.go
index cb6a6581d8..f41c247c6d 100644
--- a/agent/structs/config_entry_discoverychain_test.go
+++ b/agent/structs/config_entry_discoverychain_test.go
@@ -410,8 +410,17 @@ func TestConfigEntries_ListRelatedServices_AndACLs(t *testing.T) {
 			},
 		},
 		{
-			name:  "api-gateway",
-			entry: &APIGatewayConfigEntry{Name: "test"},
+			name: "api-gateway",
+			entry: &APIGatewayConfigEntry{
+				Name: "test",
+				Listeners: []APIGatewayListener{
+					{
+						Name:     "test",
+						Port:     100,
+						Protocol: "http",
+					},
+				},
+			},
 			expectACLs: []testACL{
 				{
 					name:       "no-authz",
diff --git a/agent/structs/config_entry_gateways.go b/agent/structs/config_entry_gateways.go
index 885a301fc4..5309af35ad 100644
--- a/agent/structs/config_entry_gateways.go
+++ b/agent/structs/config_entry_gateways.go
@@ -769,6 +769,9 @@ func (e *APIGatewayConfigEntry) Validate() error {
 		return err
 	}
 
+	if len(e.Listeners) == 0 {
+		return fmt.Errorf("api gateway must have at least one listener")
+	}
 	if err := e.validateListenerNames(); err != nil {
 		return err
 	}
diff --git a/agent/structs/config_entry_gateways_test.go b/agent/structs/config_entry_gateways_test.go
index ca68ea4f40..1302cb2ad7 100644
--- a/agent/structs/config_entry_gateways_test.go
+++ b/agent/structs/config_entry_gateways_test.go
@@ -1126,6 +1126,13 @@ func TestGatewayService_Addresses(t *testing.T) {
 
 func TestAPIGateway_Listeners(t *testing.T) {
 	cases := map[string]configEntryTestcase{
+		"no listeners defined": {
+			entry: &APIGatewayConfigEntry{
+				Kind: "api-gateway",
+				Name: "api-gw-one",
+			},
+			validateErr: "api gateway must have at least one listener",
+		},
 		"listener name conflict": {
 			entry: &APIGatewayConfigEntry{
 				Kind: "api-gateway",
diff --git a/website/content/commands/config/delete.mdx b/website/content/commands/config/delete.mdx
index 3fc9e6618b..134d6885e6 100644
--- a/website/content/commands/config/delete.mdx
+++ b/website/content/commands/config/delete.mdx
@@ -27,6 +27,7 @@ are not supported from commands, but may be from the corresponding HTTP endpoint
 
 | Config Entry Kind   | Required ACL       |
 | ------------------- | ------------------ |
+| api-gateway         | `mesh:write`       |
 | ingress-gateway     | `operator:write`   |
 | proxy-defaults      | `operator:write`   |
 | service-defaults    | `service:write`    |
@@ -45,16 +46,16 @@ Usage: `consul config delete [options]`
 - `-kind` - Specifies the kind of the config entry to read.
 
 - `-name` - Specifies the name of the config entry to delete. The name of the
-  `proxy-defaults` config entry must be `global`, and the name of the `mesh`
-  config entry must be `mesh`.
+`proxy-defaults` config entry must be `global`, and the name of the `mesh`
+config entry must be `mesh`.
 
 - `-filename` - Specifies the file describing the config entry to delete.
 
 - `-cas` - Perform a Check-And-Set operation. Specifying this value also
-  requires the -modify-index flag to be set. The default value is false.
+requires the -modify-index flag to be set. The default value is false.
 
 - `-modify-index=<int>` - Unsigned integer representing the ModifyIndex of the
-  config entry. This is used in combination with the -cas flag.
+config entry. This is used in combination with the -cas flag.
 
 #### Enterprise Options
 
diff --git a/website/content/commands/config/list.mdx b/website/content/commands/config/list.mdx
index c72e3e903d..1a70af1787 100644
--- a/website/content/commands/config/list.mdx
+++ b/website/content/commands/config/list.mdx
@@ -27,6 +27,7 @@ are not supported from commands, but may be from the corresponding HTTP endpoint
 
 | Config Entry Kind   | Required ACL      |
 | ------------------- | ----------------- |
+| api-gateway         | `mesh:read`       |
 | ingress-gateway     | `service:read`    |
 | proxy-defaults      | `<none>`          |
 | service-defaults    | `service:read`    |
diff --git a/website/content/commands/config/read.mdx b/website/content/commands/config/read.mdx
index a50574aaed..7a49482c5b 100644
--- a/website/content/commands/config/read.mdx
+++ b/website/content/commands/config/read.mdx
@@ -28,6 +28,7 @@ are not supported from commands, but may be from the corresponding HTTP endpoint
 
 | Config Entry Kind   | Required ACL      |
 | ------------------- | ----------------- |
+| api-gateway         | `mesh:read`       |
 | ingress-gateway     | `service:read`    |
 | proxy-defaults      | `<none>`          |
 | service-defaults    | `service:read`    |
diff --git a/website/content/commands/config/write.mdx b/website/content/commands/config/write.mdx
index 7e586aff75..24e17aa34a 100644
--- a/website/content/commands/config/write.mdx
+++ b/website/content/commands/config/write.mdx
@@ -30,6 +30,7 @@ are not supported from commands, but may be from the corresponding HTTP endpoint
 
 | Config Entry Kind   | Required ACL       |
 | ------------------- | ------------------ |
+| api-gateway         | `mesh:write`       |
 | ingress-gateway     | `operator:write`   |
 | proxy-defaults      | `operator:write`   |
 | service-defaults    | `service:write`    |