---
title: "Default off: exchange a role credential for a one-use TCP ticket"
method: POST
path: "/v1/public/gateway/tcp/tickets"
---

# Default off: exchange a role credential for a one-use TCP ticket

`POST /v1/public/gateway/tcp/tickets`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/public/gateway/tcp/tickets`
- Auth: HTTP bearer

Default off. Native connectors and local tunnels supply the matching role credential in Authorization, never an organization API key. Rechecks ready route, current generation, role and the authorizing administrator's current paid active entitlement. A ticket expires in 60 seconds and is redeemed atomically once by the broker. At most 32 outstanding tickets per route, 120 requests/minute and 4096-byte JSON bodies. Compare route_id, tenant_host, gateway_url and the canonical resource/hash against local configuration before CONNECT. The service never receives TCP payloads or chooses a connector target.

## Request body

- HostedGatewayTcpTicketRequest
  - `route_id` string, uuid, required
  - `role` 'connector' | 'client', required

## Response `200`

Private bounded result.

- HostedGatewayTcpTicketResponse: A one-use ticket expires in 60 seconds. Verify every returned binding against local configuration before CONNECT; never infer authorization from shape alone. Roles have separate route credentials.
  - `ticket` string, required: Sensitive opaque capability; never put in a URL, log, analytics event or ordinary resource view.
  - `expires_at` string, date-time, required
  - `route_id` string, uuid, required
  - `tenant_host` string, required
  - `gateway_url` string, uri, required
  - `resource` string, required
  - `resource_hash` string, required: SHA-256 lowercase hex of the canonical saved numeric IP:port resource string, not a customer payload.

## Other responses

- `400`: INVALID_REQUEST or ordinary validation refusal for missing, oversized, invalid or unexpected body fields.
- `401`: TCP_CREDENTIAL_REQUIRED: a 43-character opaque route bearer is required.
- `403`: TCP_AUTHORIZATION_REFUSED, HOSTED_GATEWAY_ADMIN_REQUIRED, HOSTED_GATEWAY_PAID_PLAN_REQUIRED or HOSTED_GATEWAY_ENTITLEMENT_INACTIVE. Current authorizing administrator membership and paid active entitlement are rechecked; no fallback authorization.
- `415`: JSON_CONTENT_TYPE_REQUIRED.
- `429`: TCP_TICKET_LIMIT or request rate limit reached.
- `503`: TCP_UNAVAILABLE when a required dependency is unavailable or a gated operation is disabled. Internal service configuration may return TCP_SERVICE_UNAVAILABLE. Fail closed; no ticket, lease or traffic authority is granted.

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)