---
title: "Provision a Gateway"
method: POST
path: "/sites/{site_id}/gateways"
tags: ["Gateways"]
---

# Provision a Gateway

`POST /sites/{site_id}/gateways`

Creates a Gateway and mints its single-owner token in one call. The token is returned once here - store it securely. If it's lost, rotate it via `POST /sites/{site_id}/gateways/{gateway_id}/token/rotate` once the Gateway has connected, or delete and re-provision it.

`name` is optional; a random name is generated when omitted. `ipv4` and `ipv6` are the Gateway's tunnel addresses, allocated from the account's pool when the Gateway row is created - they are always present in this response, before the Gateway has ever connected.

## Path parameters

- `site_id` string, required

## Request body

- GatewayCreateRequest — Request body for provisioning a Gateway
  - `gateway` GatewayCreate — Create schema for a single Gateway
    - `name` string — Gateway Name. Randomly generated when omitted.

## Response `201`

Provisioned Gateway Response

- GatewayProvisionResponse — Response schema for a newly provisioned Gateway. Includes the one-time token secret - it is not shown again.
  - `data` object — Gateway
    - `gateway_token_id` string, uuid, nullable — ID of the token this Gateway last connected with. Null until the Gateway connects for the first time.
    - `id` string, uuid, required — Gateway ID
    - `ipv4` string, required — Tunnel IPv4 address (see last_seen_remote_ip for the public IP)
    - `ipv6` string, required — Tunnel IPv6 address (see last_seen_remote_ip for the public IP)
    - `last_seen_at` string, nullable — Timestamp of the latest connection
    - `last_seen_remote_ip` string, nullable — Remote IP from the latest session
    - `last_seen_remote_ip_location_city` string, nullable — Remote IP city from the latest session
    - `last_seen_remote_ip_location_lat` number, nullable — Remote IP latitude from the latest session
    - `last_seen_remote_ip_location_lon` number, nullable — Remote IP longitude from the latest session
    - `last_seen_remote_ip_location_region` string, nullable — Remote IP region from the latest session
    - `last_seen_user_agent` string, nullable — User agent from the latest session
    - `last_seen_version` string, nullable — Gateway version from the latest session
    - `name` string, required — Gateway Name
    - `online` boolean, required — Online status of Gateway
    - `public_key` string, nullable — WireGuard public key from the latest session
    - `rotated_at` string, date-time, nullable — When the token identified by `gateway_token_id` was rotated out. Null in the normal case. When set, a replacement token has been minted and this one stays valid only until the Gateway connects with the replacement or 4 hours elapse from this timestamp, whichever comes first - so a non-null value means a rotation is pending and the Gateway has not picked it up yet.
    - `token` string, required — One-time Gateway token secret

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `404` — Not Found
- `422` — Unprocessable Content
- `429` — Too Many Requests

---

[API](https://skmtc.dev/firezone/apis/firezone-api.md) · [All operations](https://skmtc.dev/firezone/apis/firezone-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/firezone/firezone-api/revisions/110de2cb2283/schema)