---
title: "Tunnel Status"
method: GET
path: "/tunnel/status/{tenant_id}"
---

# Tunnel Status

`GET /tunnel/status/{tenant_id}`

## Request

- Base URL: `https://usemeridian.us` (the document declares no server; this is the origin it was published from)
- URL: `https://usemeridian.us/tunnel/status/{tenant_id}`
- Auth: none declared

Return whether the tenant currently has an active tunnel socket.

89a06e40 — ``request`` is a NEW parameter (this route previously took
only ``tenant_id``), added to reach ``request.app.state.db`` for the
``profile_binding`` field below. Defaulted to ``None`` rather than made
required: several existing tests (``test_slot_reprobe.py``,
``test_tunnel_bridge.py``, ``test_w5_9665538a_meridian_docs_slot.py``)
call this function directly as a plain coroutine (``tn.tunnel_status(tid)``),
not through FastAPI's HTTP layer — FastAPI still injects the real
``Request`` for actual HTTP calls regardless of the default (it
recognizes the ``Request`` type annotation, not the absence of a
default), so this stays a non-breaking change for both calling styles.
``profile_binding`` degrades to ``None`` (see below) when ``request`` is
``None``, exactly like every other best-effort field in this response.

4bea8629 — SECURITY FIX: this route previously had NO auth at all
(see the "no auth required" note that used to head this section),
unlike its documentary-tenant_id siblings ``/tunnel/diagnostics/{tenant_id}``
and ``/tunnel/launch-matrix/{tenant_id}`` (which resolve the REAL caller
via ``_get_tenant_from_request`` and treat the path's ``tenant_id`` as
informational only). Anyone who knew or guessed a ``tenant_id`` could
fetch this response — live per-slot health, config generation, and
in-flight request counts for that tenant. Fix: in hosted mode, resolve
the caller's own tenant the same way, and hard-require it match the
path's ``tenant_id`` (mirroring ``tunnel_ws``'s own WS-side check and
the tunnel HTTP/WS proxy routes' 5de3d422 fix). A direct, non-HTTP call
(``request is None`` — see above) is unaffected, same as the
``profile_binding`` degrade. ``/tunnel/openai/diagnostics/{tenant_id}``
is intentionally unauthenticated per its own docstring and is NOT
touched by this fix.

## Path parameters

- `tenant_id` string, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/usemeridian/apis/meridian.md) · [All operations](https://skmtc.dev/usemeridian/apis/meridian/llms.txt) · [OpenAPI document](https://skmtc.dev/usemeridian/apis/meridian/revisions/f37a894bd374?raw)