---
title: "Default off, broker only: redeem a TCP ticket into a lease"
method: POST
path: "/v1/internal/gateway/tcp/redeem"
---

# Default off, broker only: redeem a TCP ticket into a lease

`POST /v1/internal/gateway/tcp/redeem`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/gateway/tcp/redeem`
- Auth: HTTP bearer

Internal broker only; excluded from public SDK methods. Default off. Check exact tenant, route, role, generation, credential, unconsumed ticket and current authorizing administrator/paid authority. Atomic admission limits are 128 live legs globally, 16 per organization and 8 per route. A consumed ticket remains consumed after broker restart. Compare every returned lease binding. Strict JSON, 4096-byte bodies, 2000 requests/minute.

## Request body

- HostedGatewayTcpRedeem
  - `ticket` string, required: Sensitive opaque capability; never put in a URL, log, analytics event or ordinary resource view.
  - `route_id` string, uuid, required
  - `tenant_host` string, required
  - `role` 'connector' | 'client', required

## Response `200`

Private bounded result.

- HostedGatewayTcpLeaseGrant: Broker-only 30-second lease grant. Compare every binding, refresh every 10 seconds, and close before the last valid expiry if renewal fails. Expired leases never revive; maximum leg lifetime is one hour. Route keys cannot redeem or renew a lease.
  - `lease_id` string, uuid, required
  - `lease_token` string, required: Sensitive opaque capability; never put in a URL, log, analytics event or ordinary resource view.
  - `org_id` string, uuid, required
  - `route_id` string, uuid, required
  - `generation` integer, required: Non-secret fencing generation. Discard stale reveals and clear displayed credentials when this changes.
  - `tenant_host` string, required
  - `role` 'connector' | 'client', required
  - `resource_hash` string, required: SHA-256 lowercase hex of the canonical saved numeric IP:port resource string, not a customer payload.
  - `expires_at` string, date-time, required

## Other responses

- `400`: INVALID_REQUEST or ordinary validation refusal for missing, oversized, invalid or unexpected body fields.
- `401`: TCP_SERVICE_UNAUTHORIZED: dedicated service authentication failed; customer route, organization and account credentials are never accepted.
- `403`: TCP_AUTHORIZATION_REFUSED, HOSTED_GATEWAY_ADMIN_REQUIRED, HOSTED_GATEWAY_PAID_PLAN_REQUIRED or HOSTED_GATEWAY_ENTITLEMENT_INACTIVE. Current authorizing administrator membership and paid active entitlement are rechecked; no fallback authorization.
- `415`: JSON_CONTENT_TYPE_REQUIRED.
- `429`: TCP_CONNECTION_LIMIT or request rate limit reached.
- `503`: TCP_UNAVAILABLE when a required dependency is unavailable or a gated operation is disabled. Internal service configuration may return TCP_SERVICE_UNAVAILABLE. Fail closed; no ticket, lease or traffic authority is granted.

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)