Default off: exchange a role credential for a one-use TCP ticket

Default off. Native connectors and local tunnels supply the matching role credential in Authorization, never an organization API key. Rechecks ready route, current generation, role and the authorizing administrator's current paid active entitlement. A ticket expires in 60 seconds and is redeemed atomically once by the broker. At most 32 outstanding tickets per route, 120 requests/minute and 4096-byte JSON bodies. Compare route_id, tenant_host, gateway_url and the canonical resource/hash against local configuration before CONNECT. The service never receives TCP payloads or chooses a connector target.

post/v1/public/gateway/tcp/tickets

Request

  • Base URL: https://api.decionis.com
  • URL: https://api.decionis.com/v1/public/gateway/tcp/tickets
  • Auth: HTTP bearer

Request body

route_idstring uuid required
role'connector' | 'client' required

Response

Private bounded result.

ticketstring required

Sensitive opaque capability; never put in a URL, log, analytics event or ordinary resource view.

expires_atstring date-time required
route_idstring uuid required
tenant_hoststring required
gateway_urlstring uri required
resourcestring required
resource_hashstring required

SHA-256 lowercase hex of the canonical saved numeric IP:port resource string, not a customer payload.

Changes

No recorded changes to this operation across all 1 revision of this API.