Reveal both TCP credentials once for the expected generation
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. The organization comes only from the session. Requests are closed and limited to 4096 bytes. TCP forwarding is opaque and does not evaluate SQL or API commands. Default off. Requires the route to be ready and its current authorizing administrator to retain paid active entitlement. The generation from the latest resource read is compared under the route lock before disclosure is consumed. Stale requests never consume replacement credentials. Do not cache, log or automatically retry a credential disclosure.
Authorization
AccountSessionCookie The signed HttpOnly account session the web app holds after sign-in (also accepted as a Bearer acct_ token).
In: cookie
Path Parameters
Saved resource UUID in the current workspace; also the TCP route UUID.
uuidRequest Body
application/json
Non-secret fencing generation. Discard stale reveals and clear displayed credentials when this changes.
1 <= value <= 2147483647Response Body
application/json
curl -X POST "https://example.com/v1/public/account/workspace/deployments/resources/497f6eca-6276-4993-bfeb-53cbbbba6f08/tcp/credentials/reveal" \ -H "Content-Type: application/json" \ -d '{ "generation": 1 }'{ "route_id": "dd833dbc-f3c5-44d9-98a2-7ba12ebc8160", "tenant_host": "string", "gateway_url": "http://example.com", "resource": "string", "resource_hash": "string", "connector_credential": "string", "client_credential": "string"}Revoke a TCP route and both role credentials POST
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. The organization comes only from the session. Requests are closed and limited to 4096 bytes. TCP forwarding is opaque and does not evaluate SQL or API commands. Works while the TCP feature is disabled. Increments generation, clears both role credentials, and removes tickets and live leases. Existing broker legs close by their last valid 30-second lease expiry. Other resources and HTTPS routing are unchanged.
Default off: exchange a role credential for a one-use TCP ticket POST
Default off. Native connectors and local tunnels supply the matching role credential in Authorization, never an organization API key. Rechecks ready route, current generation, role and the authorizing administrator's current paid active entitlement. A ticket expires in 60 seconds and is redeemed atomically once by the broker. At most 32 outstanding tickets per route, 120 requests/minute and 4096-byte JSON bodies. Compare route_id, tenant_host, gateway_url and the canonical resource/hash against local configuration before CONNECT. The service never receives TCP payloads or chooses a connector target.