Reveal one gateway's gateway token, once
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. Acts on the gateway deployment_id names, else the primary. Returns the token that gateway sends the tenant's API in AgentSafe-Gateway-Token on every forwarded request, exactly once, after the fleet verified the gateway. Decionis mints it with the tenant key and keeps it sealed for the fleet; a token that was not saved is replaced by regenerating it. sent says whether every pod sends it now. An explicit id the workspace does not hold is 404 GATEWAY_NOT_FOUND.
Authorization
AccountSessionCookie The signed HttpOnly account session the web app holds after sign-in (also accepted as a Bearer acct_ token).
In: cookie
Query Parameters
One of the current workspace's gateways; omitted, the workspace's primary. The organization always comes from the session, never from a parameter.
uuidRequest Body
application/json
Response Body
application/json
curl -X POST "https://example.com/v1/public/account/workspace/deployments/gateway-token/reveal" \ -H "Content-Type: application/json" \ -d '{}'{ "gateway_token": "string", "header": "AgentSafe-Gateway-Token", "sent": true}Reveal one gateway's ingress (tenant) key, once POST
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. Acts on the gateway deployment_id names, else the primary. Returns that gateway's AgentSafe-Tenant-Key exactly once, after the fleet verified it; each gateway has its own key. An explicit id the workspace does not hold is 404 GATEWAY_NOT_FOUND.
Make a new gateway token for one gateway, shown once and kept pending POST
Signed account session, current workspace ADMIN or OWNER and verified email; same-site JSON is mandatory. Acts on the gateway deployment_id names, else the primary, once it has been ready. Returns a new 256-bit token exactly once and keeps it pending, sealed; the gateway goes on sending the token in use until the token is activated, so the tenant's API can accept both first. Regenerating again replaces a pending token not yet activated. An explicit id the workspace does not hold is 404 GATEWAY_NOT_FOUND.