---
title: "Update Tunnel"
method: PATCH
path: "/workspaces/{workspace_id}/tunnels/{tunnel_id}"
tags: ["tunnels"]
---

# Update Tunnel

`PATCH /workspaces/{workspace_id}/tunnels/{tunnel_id}`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/tunnels/{tunnel_id}`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Update a tunnel. Sending `client_secret` rotates the stored secret.

## Path parameters

- `tunnel_id` string, uuid, required
- `workspace_id` string, uuid, required

## Request body

- TunnelUpdate
  - `name` string, nullable
  - `description` string, nullable
  - `endpoint` string, uri, nullable
  - `client_id` string, nullable
  - `client_secret` string, password, nullable
  - `allowed_targets` TunnelTarget[], nullable
    - `host` string, required: Exact hostname or IP address. Wildcards and CIDR ranges are not allowed.
    - `ports` integer[], required
  - `enabled` boolean, nullable

## Response `200`

Successful Response

- TunnelRead: Tunnel metadata. The client secret is write-only and never returned.
  - `id` string, uuid, required
  - `workspace_id` string, uuid, required
  - `name` string, required
  - `description` string, nullable, required
  - `provider` 'pangolin', required
  - `endpoint` string, required
  - `client_id` string, required
  - `allowed_targets` TunnelTarget[], required
    - `host` string, required: Exact hostname or IP address. Wildcards and CIDR ranges are not allowed.
    - `ports` integer[], required
  - `enabled` boolean, required
  - `has_gateway_key` boolean, required
  - `managed` boolean, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)