---
title: "🛡️ Enable Remote Access."
method: POST
path: "/api/v1/connect/enable"
tags: ["Remote Access"]
---

# 🛡️ Enable Remote Access.

`POST /api/v1/connect/enable`

Issues a Remote Access credential from Cardinal Cloud for this server and opens the control channel. Requires the cloud account JWT header.<br /><hr /><h3>🛡️ Requires Capabilities: <code>ServerSettings.Update</code></h3>

## Headers

- `CardinalTolkien` string

## Response `200`

- ConnectStatusResponse
  - `enabled` boolean, required — Whether Remote Access is enabled on this server.
  - `state` 'disconnected' | 'connecting' | 'connected' | 'auth_failed' | 'not_approved' | 'suspended', required — Live state of the control channel to the Remote Access Server. `not_approved` means the cloud account is waiting on service access for a Remote Access feature, and `suspended` means the account is suspended; both retry on their own.
  - `hostname` string, nullable, required — The hostname assigned by the Remote Access Server, once registered.
  - `vanityHostname` string, nullable, required — The owner-chosen vanity hostname, once the certificate covers it. Preferred over `hostname` when set.
  - `signingKeyFingerprint` string, nullable, required — Truncated SHA-256 fingerprint of the probe signing key, for support diagnostics.
  - `tokenExpiresAt` string, nullable, required — Expiry of the stored cloud credential, ISO 8601.
  - `publicPort` number, nullable, required — The externally reachable port advertised to the Remote Access Server.
  - `directUrl` string, nullable, required — The URL clients use to reach this server directly. Null until a hostname is assigned.
  - `relayUrl` string, nullable, required — The URL clients use to reach this server through the relay.
  - `https` ConnectHttpsStatus, required
    - `state` 'stopped' | 'running' | 'error', required — State of the Remote Access HTTPS listener, which serves direct connections.
    - `port` number, nullable, required — The port the listener is bound to, once running.
    - `certExpiresAt` string, nullable, required — Expiry of the TLS certificate in use, ISO 8601.
    - `lastError` string, nullable, required — Why the listener could not start or why cert material was rejected.

## Other responses

- `201`
- `400` — Possible reasons: Request validation failed, see response for details; The cloud account JWT header is missing.
- `401` — Possible reasons: The authorization token is invalid.
- `403` — Possible reasons: The user does not have sufficent capabilities; The cloud account has no approved access to Remote Access, and the request has been queued (code <code>service_access_required</code>).
- `409` — The cloud IDP refused: every server slot on the cloud account is occupied.

## Changes

- **2026-08-21** `8bcf1f05a7f7` — 2 info
  - added the required property `vanityHostname` to the response with the `200` status
  - added the required property `vanityHostname` to the response with the `201` status
- **2026-08-16** `4e6c4e963749` — 4 warning
  - added the new `not_approved` enum value to the `state` response property for the response status `200`
  - added the new `not_approved` enum value to the `state` response property for the response status `201`
  - added the new `suspended` enum value to the `state` response property for the response status `200`
  - added the new `suspended` enum value to the `state` response property for the response status `201`
- **2026-08-14** `f1078caf010b` — 1 info
  - added the non-success response with the status `409`
- **2026-08-14** `5b4d68eba1df` — 4 breaking
  - removed the required property `directEnabled` from the response with the `200` status
  - removed the required property `directEnabled` from the response with the `201` status
  - removed the required property `relayEnabled` from the response with the `200` status
  - removed the required property `relayEnabled` from the response with the `201` status
- …earlier changes not shown

[Full history](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/changes/api/v1/connect/enable/post.md)

---

[API](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api.md) · [All operations](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardinalapps/cardinal-media-server-api/revisions/7b5e4555e84f/schema)