---
title: "Create Managed Tunnel"
method: POST
path: "/workspaces/{workspace_id}/tunnels/managed"
tags: ["tunnels"]
---

# Create Managed Tunnel

`POST /workspaces/{workspace_id}/tunnels/managed`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/tunnels/managed`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Create a tunnel whose Pangolin site, machine client, and resources Tracecat provisions.

The site credentials and install command are returned only in this response.

## Path parameters

- `workspace_id` string, uuid, required

## Request body

- ManagedTunnelCreate: Create a tunnel whose Pangolin site, machine client, and resources Tracecat manages.
  - `name` string, required
  - `description` string, nullable
  - `allowed_targets` TunnelTarget[], required
    - `host` string, required: Exact hostname or IP address. Wildcards and CIDR ranges are not allowed.
    - `ports` integer[], required

## Response `201`

Successful Response

- ManagedTunnelCreated: A new managed tunnel. The site credentials are only returned once.
  - `tunnel` TunnelRead, required: Tunnel metadata. The client secret is write-only and never returned.
    - `id` string, uuid, required
    - `workspace_id` string, uuid, required
    - `name` string, required
    - `description` string, nullable, required
    - `provider` 'pangolin', required
    - `endpoint` string, required
    - `client_id` string, required
    - `allowed_targets` TunnelTarget[], required
      - `host` string, required: Exact hostname or IP address. Wildcards and CIDR ranges are not allowed.
      - `ports` integer[], required
    - `enabled` boolean, required
    - `has_gateway_key` boolean, required
    - `managed` boolean, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `site_id` string, required
  - `site_secret` string, required
  - `site_endpoint` string, required
  - `site_install_command` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)