---
title: "Broker only: prove control API authentication and database readiness"
method: POST
path: "/v1/internal/gateway/tcp/health"
---

# Broker only: prove control API authentication and database readiness

`POST /v1/internal/gateway/tcp/health`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/gateway/tcp/health`
- Auth: HTTP bearer

Internal broker only; excluded from public SDK methods. Requires the configured dedicated broker bearer and a successful database check. Works while HOSTED_GATEWAY_TCP_ENABLED is false; ready:true grants no traffic authority. The broker caches a successful probe at most 10 seconds and expires readiness proof after 30 seconds; authentication refusal invalidates it immediately. Strict empty JSON, 4096-byte bodies, 2000 requests/minute.

## Request body

- HostedGatewayTcpEmpty

## Response `200`

Private bounded result.

- HostedGatewayTcpHealth
  - `transport` 'agentsafe-tcp-relay/1', required
  - `ready` true, required

## Other responses

- `400`: INVALID_REQUEST or ordinary validation refusal for missing, oversized, invalid or unexpected body fields.
- `401`: TCP_SERVICE_UNAUTHORIZED: dedicated service authentication failed; customer route, organization and account credentials are never accepted.
- `415`: JSON_CONTENT_TYPE_REQUIRED.
- `429`: Request rate or bounded connection capacity reached.
- `503`: TCP_UNAVAILABLE when a required dependency is unavailable or a gated operation is disabled. Internal service configuration may return TCP_SERVICE_UNAVAILABLE. Fail closed; no ticket, lease or traffic authority is granted.

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)