Default off: exchange a role credential for a one-use TCP ticket
Default off. Native connectors and local tunnels supply the matching role credential in Authorization, never an organization API key. Rechecks ready route, current generation, role and the authorizing administrator's current paid active entitlement. A ticket expires in 60 seconds and is redeemed atomically once by the broker. At most 32 outstanding tickets per route, 120 requests/minute and 4096-byte JSON bodies. Compare route_id, tenant_host, gateway_url and the canonical resource/hash against local configuration before CONNECT. The service never receives TCP payloads or chooses a connector target.
Authorization
HostedGatewayTcpRouteCredential A role-specific opaque 43-character connector or client credential revealed by the verified workspace administrator. Accepted only for TCP ticket issuance, never an organization API key, account session, worker credential or broker credential.
In: header
Request Body
application/json
uuidValue in
- "connector"
- "client"
Response Body
application/json
curl -X POST "https://example.com/v1/public/gateway/tcp/tickets" \ -H "Content-Type: application/json" \ -d '{ "route_id": "dd833dbc-f3c5-44d9-98a2-7ba12ebc8160", "role": "connector" }'{ "ticket": "string", "expires_at": "2019-08-24T14:15:22Z", "route_id": "dd833dbc-f3c5-44d9-98a2-7ba12ebc8160", "tenant_host": "string", "gateway_url": "http://example.com", "resource": "string", "resource_hash": "string"}Reveal both TCP credentials once for the expected generation POST
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. The organization comes only from the session. Requests are closed and limited to 4096 bytes. TCP forwarding is opaque and does not evaluate SQL or API commands. Default off. Requires the route to be ready and its current authorizing administrator to retain paid active entitlement. The generation from the latest resource read is compared under the route lock before disclosure is consumed. Stale requests never consume replacement credentials. Do not cache, log or automatically retry a credential disclosure.
Grant a workspace's contracted hosted-enforcement permission POST
Records an operator-reviewed agreement as a workspace- and current-plan-bound hosted-enforcement operation permission. The expected plan is compared with current paid API access and the existing Account entitlement authority; it never changes billing, product plans or Account projections. Catalog plans already including enforcement need no exception and return a conflict. An explicitly prefixed owner-attestation reference remains labeled owner attestation in the durable audit. The customer ADMIN/OWNER approval, workspace beta gate, ownership proof, readiness and dedicated custody are still required. A successful receipt is not runtime activation. JSON only, bounded to 4096 bytes, ten requests per minute per address and twenty per hour per verified operator through the existing shared start limit. Every response is no-store. The request UUID binds action, org, grant where applicable, verified operator oid/tenant and normalized body. Exact retries return the original identity and audit references; rebinding returns 409. Operator identity, capability, credentials, consent, beta, billing changes and other extra fields are refused. Reasons and agreement references appear only in the transactional operator audit.