---
title: "PUT /internal/nodes/{node_id}/public-ingress/settings"
method: PUT
path: "/internal/nodes/{node_id}/public-ingress/settings"
tags: ["Nodes"]
---

# PUT /internal/nodes/{node_id}/public-ingress/settings

`PUT /internal/nodes/{node_id}/public-ingress/settings`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/internal/nodes/{node_id}/public-ingress/settings`
- Auth: HTTP bearer

## Path parameters

- `node_id` integer, required

## Request body

- UpdatePublicIngressSettingsRequest
  - `enabled` boolean, required
  - `http_port` integer, nullable
  - `https_port` integer, nullable
  - `listen_address` string, nullable: Local address to bind, or `None` for automatic.
  - `public_address` string, nullable: What DNS points at, or `None` for the listen address.

## Response `200`

- PublicIngressSettings
  - `agent_reports` boolean, required: Whether the agent reported its addresses: an agent that predates console-managed ingress never does, and keeps its flag.
  - `behind_nat` boolean, required: The listen address is not public but the public address is: traffic crosses a NAT, so the router must forward the ports.
  - `checked_at` string, date-time, nullable
  - `effective_public_address` string, nullable: The address DNS should point at, as far as Temps can tell.
  - `effective_public_scope` 'public' | 'private' | 'cgnat' | 'local': Who can reach an address.
  - `enabled` boolean, required
  - `http_port` integer, required
  - `https_port` integer, required
  - `interfaces` PublicIngressInterface[], required
    - `address` string, required
    - `default_route` boolean, required
    - `name` string, required
    - `scope` 'public' | 'private' | 'cgnat' | 'local', required: Who can reach an address.
  - `last_check` PublicIngressCheck
    - `ok` boolean, required
    - `steps` PublicIngressCheckStep[], required
      - `message` string, required
      - `ok` boolean, required
      - `step` string, required: `address`, `http` or `https`.
    - `summary` string, required
    - `target` string, nullable: The address that was dialled.
  - `last_error` string, nullable
  - `listen_address` string, nullable: Configured listen address; `None` means automatic.
  - `listener_error` string, nullable
  - `listening_http` string, nullable
  - `listening_https` string, nullable
  - `mode` 'off' | 'fixed' | 'delegated': What a worker lets its control plane do with public ingress. Set on the worker only (`temps join --ingress`, `temps agent ingress`): opening ports on a machine is its owner's decision, whoever runs the control plane.
  - `node_id` integer, required
  - `public_address` string, nullable: Configured public address; `None` means the listen address.
  - `running` boolean, nullable

## Other responses

- `400`: Invalid address or ports, or not a worker
- `404`: Node not found

## Changes

> 98 revisions in range; 1 not diffed.

- **2026-10-22** `d8a717162ef5`: 1 info
  - endpoint added
- **2026-10-22** `06005615b19e`: 1 breaking
  - api path removed without deprecation
- **2026-10-22** `7d41b820a372`: 1 info
  - endpoint added
- **2026-10-22** `add7f7b41ae2`: 1 breaking
  - api path removed without deprecation
- **2026-10-21** `842d42ed4659`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/gotempsh/apis/temps/changes/internal/nodes/:node_id/public-ingress/settings/put.md)

---

[API](https://skmtc.dev/gotempsh/apis/temps.md) - [All operations](https://skmtc.dev/gotempsh/apis/temps/llms.txt) - [OpenAPI document](https://skmtc.dev/gotempsh/apis/temps/revisions/fdfa2df06ae7?raw)