LinkLabel

Update operator-controlled fields on a Link Label

Update operator-managed fields on a Link Label. v1 surface is restricted to operator_tunables_overrides — the only writable field on this endpoint. The resolved operator_tunables view is recomputed on every read (defaults ⊕ label overrides); per-Agent overrides on individual LinkAgent records layer on top. See the operator-control-plane design doc for details. To clear every label-level override at once, use DELETE /link/{workspace_id}/label/{label}/operator-tunables-overrides.

patch/link/{workspace_id}/label/{label}

Request

  • Base URL: https://api.mabl.com
  • URL: https://api.mabl.com/link/{workspace_id}/label/{label}
  • Auth: one of:
    • HTTP basic
    • API key in header Authorization

Path parameters

workspace_idstring required

The id of the workspace

labelstring required

The label associated with the link stack to update

Query parameters

field_maskstring[]

Comma-separated list of fields to update. If provided, only fields in the mask are written; fields in the mask but absent from the body are cleared. Without a mask the entire sparse body is applied (fields with x-dao-apply-nulls honour null-clears).

Headers

If-Matchstring

Conditional update — succeeds only if the label's current ETag matches.

Request body

idstring

UUID for this Link Label

created_timeinteger

Time at which the Link Label was created

labelstring

The link label

cloud_safe_canonical_namestring

The globally unique name for this label that is safe to use in FQDNs (based on label and workspace ID).

client_certificatestring

The serialized X.509 certificate Link Agents use as their client identity on the legacy Link Tunnel mTLS path. Not used by mablnet: mablnet's HostCredentials are a separate JSON blob (workspace_id + label + host_id + issued_at + nonce); the mabl-deployment HostAuthenticator validates that blob via the POST /link/mablnet/authorize/host endpoint and maps it to mablnet_tenant_id. Also distinct from the per-Host peer QUIC certs mablnet's CertificateAuthority issues at join time, which embed (tenantId, hostId) in SAN OtherName extensions.

server_certificatestring

The serialized certificate for Link Servers to use

client_fingerprintstring

The fingerprint of the client certificate

client_public_keystring

The public key of the client certificate

server_fingerprintstring

The fingerprint of the server certificate

server_public_keystring

The public key of the server certificate

link_server_image_tagstring

If specified, overrides the default Link Server image tag in this environment

link_server_size'small' | 'large'

The size of the Link Server, which determines its resource allocation

termination_timeinteger

The time this was terminated at

terminated_by_idstring

The client id that terminated this link labe;l

workspace_idstring

The workspace that owns this label, for workspace-owned tunnels. Also the identity the legacy Link Tunnel path and the per-label mTLS certs are keyed by. Unset for company-owned tunnels (which are mablnet-only) — read owner_type/owner_id for the canonical scope.

owner_type'workspace' | 'company' | 'user'

The kind of entity a mablnet tunnel is scoped to — its "owner". workspace is the classic scope: one tunnel per workspace. company scopes a single tunnel to an entire company, so every workspace under that company shares one mablnet tenant (and one Link Agent fleet) instead of needing a tunnel each. user is a personal tunnel scoped to a single user, private to that user — its egress is the user's own machine, used to route a cloud test run through it. All three are mablnet-only: legacy Link Tunnel is always workspace-scoped.

owner_idstring

The id of the owning entity — equals workspace_id for workspace tunnels, the company id for company tunnels.

link_infrastructure_keystring

The link infrastructure cluster this tunnel lives on, recorded for personal (user-owned) tunnels only. Server-derived at announce from the owner's workspace associations and folded into the label's identity (the label is a hash of machine_identity and this key), so a placement change produces a new tunnel rather than mutating this one. Absent on workspace- and company-owned labels — their placement always derives live from the owning company's link_infrastructure_key — and on personal labels announced before placement existed, which live on the shared cluster.

mablnet_tenant_idinteger

32-bit mablnet tenant identifier assigned at LinkLabel creation. Derived deterministically from a stable hash of <owner-key>:<label> — where <owner-key> is the workspace id for workspace tunnels and company:<company-id> for company tunnels — truncated into the 32-bit unsigned range, with a defensive collision check against existing LinkLabels — on the unlikely event the hash collides with an already-allocated tenant id, the value is offset (by 1 or a small random delta) until it lands in an unused slot. The chosen value is immutable for the lifetime of the LinkLabel. Used as the tenantId in mablnet's protocol. Populated lazily for legacy labels during the migration cutover; absent until the LinkLabel has been migrated or recreated. The legacy mablnet documentation calls this the "tenant id"; mabl's customer-facing name for the same concept is "Link label", and this field ties the two together.

mablnet_tenant_id_hexstring

Zero-padded 8-character lowercase hex form of mablnet_tenant_id, e.g. bee85e2b. Provided for log/grep/observability ergonomics; the numeric and hex forms always agree (both written in the same pass).

Response

The updated Link Label (with the resolved operator_tunables view recomputed).

idstring

UUID for this Link Label

created_timeinteger

Time at which the Link Label was created

labelstring

The link label

cloud_safe_canonical_namestring

The globally unique name for this label that is safe to use in FQDNs (based on label and workspace ID).

client_certificatestring

The serialized X.509 certificate Link Agents use as their client identity on the legacy Link Tunnel mTLS path. Not used by mablnet: mablnet's HostCredentials are a separate JSON blob (workspace_id + label + host_id + issued_at + nonce); the mabl-deployment HostAuthenticator validates that blob via the POST /link/mablnet/authorize/host endpoint and maps it to mablnet_tenant_id. Also distinct from the per-Host peer QUIC certs mablnet's CertificateAuthority issues at join time, which embed (tenantId, hostId) in SAN OtherName extensions.

server_certificatestring

The serialized certificate for Link Servers to use

client_fingerprintstring

The fingerprint of the client certificate

client_public_keystring

The public key of the client certificate

server_fingerprintstring

The fingerprint of the server certificate

server_public_keystring

The public key of the server certificate

link_server_image_tagstring

If specified, overrides the default Link Server image tag in this environment

link_server_size'small' | 'large'

The size of the Link Server, which determines its resource allocation

termination_timeinteger

The time this was terminated at

terminated_by_idstring

The client id that terminated this link labe;l

workspace_idstring

The workspace that owns this label, for workspace-owned tunnels. Also the identity the legacy Link Tunnel path and the per-label mTLS certs are keyed by. Unset for company-owned tunnels (which are mablnet-only) — read owner_type/owner_id for the canonical scope.

owner_type'workspace' | 'company' | 'user'

The kind of entity a mablnet tunnel is scoped to — its "owner". workspace is the classic scope: one tunnel per workspace. company scopes a single tunnel to an entire company, so every workspace under that company shares one mablnet tenant (and one Link Agent fleet) instead of needing a tunnel each. user is a personal tunnel scoped to a single user, private to that user — its egress is the user's own machine, used to route a cloud test run through it. All three are mablnet-only: legacy Link Tunnel is always workspace-scoped.

owner_idstring

The id of the owning entity — equals workspace_id for workspace tunnels, the company id for company tunnels.

link_infrastructure_keystring

The link infrastructure cluster this tunnel lives on, recorded for personal (user-owned) tunnels only. Server-derived at announce from the owner's workspace associations and folded into the label's identity (the label is a hash of machine_identity and this key), so a placement change produces a new tunnel rather than mutating this one. Absent on workspace- and company-owned labels — their placement always derives live from the owning company's link_infrastructure_key — and on personal labels announced before placement existed, which live on the shared cluster.

mablnet_tenant_idinteger

32-bit mablnet tenant identifier assigned at LinkLabel creation. Derived deterministically from a stable hash of <owner-key>:<label> — where <owner-key> is the workspace id for workspace tunnels and company:<company-id> for company tunnels — truncated into the 32-bit unsigned range, with a defensive collision check against existing LinkLabels — on the unlikely event the hash collides with an already-allocated tenant id, the value is offset (by 1 or a small random delta) until it lands in an unused slot. The chosen value is immutable for the lifetime of the LinkLabel. Used as the tenantId in mablnet's protocol. Populated lazily for legacy labels during the migration cutover; absent until the LinkLabel has been migrated or recreated. The legacy mablnet documentation calls this the "tenant id"; mabl's customer-facing name for the same concept is "Link label", and this field ties the two together.

mablnet_tenant_id_hexstring

Zero-padded 8-character lowercase hex form of mablnet_tenant_id, e.g. bee85e2b. Provided for log/grep/observability ergonomics; the numeric and hex forms always agree (both written in the same pass).

Changes

No recorded changes to this operation across all 37 revisions of this API.