---
title: "Create Tunnel"
method: POST
path: "/workspaces/{workspace_id}/tunnels"
tags: ["tunnels"]
---

# Create Tunnel

`POST /workspaces/{workspace_id}/tunnels`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/tunnels`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Create a tunnel in the workspace.

## Path parameters

- `workspace_id` string, uuid, required

## Request body

- TunnelCreate
  - `name` string, required
  - `description` string, nullable
  - `provider` 'pangolin'
  - `endpoint` string, uri, required: Base URL of the Pangolin server, either Pangolin Cloud or self-hosted.
  - `client_id` string, required
  - `client_secret` string, password, required
  - `allowed_targets` TunnelTarget[], required
    - `host` string, required: Exact hostname or IP address. Wildcards and CIDR ranges are not allowed.
    - `ports` integer[], required
  - `enabled` boolean

## Response `201`

Successful Response

- TunnelRead: Tunnel metadata. The client secret is write-only and never returned.
  - `id` string, uuid, required
  - `workspace_id` string, uuid, required
  - `name` string, required
  - `description` string, nullable, required
  - `provider` 'pangolin', required
  - `endpoint` string, required
  - `client_id` string, required
  - `allowed_targets` TunnelTarget[], required
    - `host` string, required: Exact hostname or IP address. Wildcards and CIDR ranges are not allowed.
    - `ports` integer[], required
  - `enabled` boolean, required
  - `has_gateway_key` boolean, required
  - `managed` boolean, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)