---
title: "Default off, broker only: renew a still-valid TCP lease"
method: POST
path: "/v1/internal/gateway/tcp/leases/refresh"
---

# Default off, broker only: renew a still-valid TCP lease

`POST /v1/internal/gateway/tcp/leases/refresh`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/gateway/tcp/leases/refresh`
- Auth: HTTP bearer

Internal broker only; excluded from public SDK methods. Default off. Refresh every 10 seconds. Recheck enabled route, generation, role credential and current authorizing administrator membership and paid active entitlement. Return the same bound grant with at most 30 seconds of validity; an expired lease never revives and total lifetime cannot exceed one hour. The broker closes a leg before the last valid expiry if renewal fails. Strict JSON, 4096-byte bodies, 2000 requests/minute.

## Request body

- HostedGatewayTcpLeaseRefresh
  - `lease_id` string, uuid, required
  - `lease_token` string, required: Sensitive opaque capability; never put in a URL, log, analytics event or ordinary resource view.
  - `phase` 'waiting' | 'active', required

## Response `200`

Private bounded result.

- HostedGatewayTcpLeaseGrant: Broker-only 30-second lease grant. Compare every binding, refresh every 10 seconds, and close before the last valid expiry if renewal fails. Expired leases never revive; maximum leg lifetime is one hour. Route keys cannot redeem or renew a lease.
  - `lease_id` string, uuid, required
  - `lease_token` string, required: Sensitive opaque capability; never put in a URL, log, analytics event or ordinary resource view.
  - `org_id` string, uuid, required
  - `route_id` string, uuid, required
  - `generation` integer, required: Non-secret fencing generation. Discard stale reveals and clear displayed credentials when this changes.
  - `tenant_host` string, required
  - `role` 'connector' | 'client', required
  - `resource_hash` string, required: SHA-256 lowercase hex of the canonical saved numeric IP:port resource string, not a customer payload.
  - `expires_at` string, date-time, required

## Other responses

- `400`: INVALID_REQUEST or ordinary validation refusal for missing, oversized, invalid or unexpected body fields.
- `401`: TCP_SERVICE_UNAUTHORIZED: dedicated service authentication failed; customer route, organization and account credentials are never accepted.
- `403`: TCP_AUTHORIZATION_REFUSED, HOSTED_GATEWAY_ADMIN_REQUIRED, HOSTED_GATEWAY_PAID_PLAN_REQUIRED or HOSTED_GATEWAY_ENTITLEMENT_INACTIVE. Current authorizing administrator membership and paid active entitlement are rechecked; no fallback authorization.
- `415`: JSON_CONTENT_TYPE_REQUIRED.
- `429`: Request rate or bounded connection capacity reached.
- `503`: TCP_UNAVAILABLE when a required dependency is unavailable or a gated operation is disabled. Internal service configuration may return TCP_SERVICE_UNAVAILABLE. Fail closed; no ticket, lease or traffic authority is granted.

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)