Sign in
LinkLabel

Clear all operator-tunable overrides on a Link Label

Clear every label-level operator-tunable override in one call, restoring the label's resolved tunables to the static defaults (per-Agent overrides on individual LinkAgent records still layer on top). The resolved operator_tunables view is recomputed on the response. To clear a single override instead, PATCH that field to null via PATCH /link/{workspace_id}/label/{label}. Idempotent — clearing when no label-level overrides are set is a no-op success.

delete/link/{workspace_id}/label/{label}/operator-tunables-overrides

Path parameters

workspace_idstring required

The id of the workspace

labelstring required

The label whose operator-tunable overrides should be cleared

Headers

If-Matchstring

Conditional clear — succeeds only if the label's current ETag matches.

Response

The updated Link Label (with the resolved operator_tunables view recomputed).

idstring

UUID for this Link Label

created_timeinteger

Time at which the Link Label was created

labelstring

The link label

cloud_safe_canonical_namestring

The globally unique name for this label that is safe to use in FQDNs (based on label and workspace ID).

client_certificatestring

The serialized X.509 certificate Link Agents use as their client identity on the legacy Link Tunnel mTLS path. Not used by mablnet: mablnet's HostCredentials are a separate JSON blob (workspace_id + label + host_id + issued_at + nonce); the mabl-deployment HostAuthenticator validates that blob via the POST /link/mablnet/authorize/host endpoint and maps it to mablnet_tenant_id. Also distinct from the per-Host peer QUIC certs mablnet's CertificateAuthority issues at join time, which embed (tenantId, hostId) in SAN OtherName extensions.

server_certificatestring

The serialized certificate for Link Servers to use

client_fingerprintstring

The fingerprint of the client certificate

client_public_keystring

The public key of the client certificate

server_fingerprintstring

The fingerprint of the server certificate

server_public_keystring

The public key of the server certificate

link_server_image_tagstring

If specified, overrides the default Link Server image tag in this environment

link_server_size'small' | 'large'

The size of the Link Server, which determines its resource allocation

termination_timeinteger

The time this was terminated at

terminated_by_idstring

The client id that terminated this link labe;l

workspace_idstring

The workspace that owns this label, for workspace-owned tunnels. Also the identity the legacy Link Tunnel path and the per-label mTLS certs are keyed by. Unset for company-owned tunnels (which are mablnet-only) — read owner_type/owner_id for the canonical scope.

owner_type'workspace' | 'company' | 'user'

The kind of entity a mablnet tunnel is scoped to — its "owner". workspace is the classic scope: one tunnel per workspace. company scopes a single tunnel to an entire company, so every workspace under that company shares one mablnet tenant (and one Link Agent fleet) instead of needing a tunnel each. user is a personal tunnel scoped to a single user, private to that user — its egress is the user's own machine, used to route a cloud test run through it. All three are mablnet-only: legacy Link Tunnel is always workspace-scoped.

owner_idstring

The id of the owning entity — equals workspace_id for workspace tunnels, the company id for company tunnels.

link_infrastructure_keystring

The link infrastructure cluster this tunnel lives on, recorded for personal (user-owned) tunnels only. Server-derived at announce from the owner's workspace associations and folded into the label's identity (the label is a hash of machine_identity and this key), so a placement change produces a new tunnel rather than mutating this one. Absent on workspace- and company-owned labels — their placement always derives live from the owning company's link_infrastructure_key — and on personal labels announced before placement existed, which live on the shared cluster.

mablnet_tenant_idinteger

32-bit mablnet tenant identifier assigned at LinkLabel creation. Derived deterministically from a stable hash of <owner-key>:<label> — where <owner-key> is the workspace id for workspace tunnels and company:<company-id> for company tunnels — truncated into the 32-bit unsigned range, with a defensive collision check against existing LinkLabels — on the unlikely event the hash collides with an already-allocated tenant id, the value is offset (by 1 or a small random delta) until it lands in an unused slot. The chosen value is immutable for the lifetime of the LinkLabel. Used as the tenantId in mablnet's protocol. Populated lazily for legacy labels during the migration cutover; absent until the LinkLabel has been migrated or recreated. The legacy mablnet documentation calls this the "tenant id"; mabl's customer-facing name for the same concept is "Link label", and this field ties the two together.

mablnet_tenant_id_hexstring

Zero-padded 8-character lowercase hex form of mablnet_tenant_id, e.g. bee85e2b. Provided for log/grep/observability ergonomics; the numeric and hex forms always agree (both written in the same pass).

Changes

No recorded changes to this endpoint across all 10 revisions of this API.