Switch one gateway to its pending gateway token
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. Acts on the gateway deployment_id names, else the primary. api_accepts_token is the administrator's statement that the tenant's API accepts the pending token. The pending token becomes the one in use and a provisioning job delivers it to every pod of the gateway; until the fleet confirms it, gateway_token.sent in the overview is false and pods may still send the previous token. With no token pending, a token in use that the fleet has not confirmed is delivered again. An explicit id the workspace does not hold is 404 GATEWAY_NOT_FOUND.
Authorization
AccountSessionCookie The signed HttpOnly account session the web app holds after sign-in (also accepted as a Bearer acct_ token).
In: cookie
Query Parameters
One of the current workspace's gateways; omitted, the workspace's primary. The organization always comes from the session, never from a parameter.
uuidRequest Body
application/json
The tenant's API accepts the pending token; the gateway switches to it.
Response Body
application/json
curl -X POST "https://example.com/v1/public/account/workspace/deployments/gateway-token/activate" \ -H "Content-Type: application/json" \ -d '{ "api_accepts_token": true }'{ "deployment": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "tenant_label": "string", "tenant_host": "string", "gateway_url": "string", "status": "reserved", "upstream_origin": "string", "runtime_verified": true }, "deployments": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "tenant_host": "acme.decionisedge.com", "is_primary": true, "status": "queued", "running_mode": "SHADOW" } ], "deployment_limit": 1, "credentials": [ {} ], "gateway_token": { "header": "AgentSafe-Gateway-Token", "issued": true, "revealable": true, "sent": true, "sent_at": "2019-08-24T14:15:22Z", "pending_at": "2019-08-24T14:15:22Z" }, "enforcement": {}, "networking": {}, "activation": {}}Make a new gateway token for one gateway, shown once and kept pending POST
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. Acts on the gateway deployment_id names, else the primary, once it has been ready. Returns a new 256-bit token exactly once and keeps it pending, sealed; the gateway goes on sending the token in use until the token is activated, so the tenant's API can accept both first. Regenerating again replaces a pending token not yet activated. An explicit id the workspace does not hold is 404 GATEWAY_NOT_FOUND.
Read one gateway's resource inventory and secret-free TCP status GET
Account session scoped to the current workspace. Reads require workspace membership. Each gateway keeps its own inventory; deployment_id names one, else the primary, and an id the workspace does not hold is 404 GATEWAY_NOT_FOUND. Saving inventory alone does not activate routing. HTTPS connected status requires a verified deployed upstream; TCP connected status requires a fresh authenticated connector lease. TCP metadata is omitted and tcp_enabled is false when the default-off feature is disabled. HTTP and WebSocket forwarding remain unsupported.