Broker only: prove control API authentication and database readiness
Internal broker only; excluded from public SDK methods. Requires the configured dedicated broker bearer and a successful database check. Works while HOSTED_GATEWAY_TCP_ENABLED is false; ready:true grants no traffic authority. The broker caches a successful probe at most 10 seconds and expires readiness proof after 30 seconds; authentication refusal invalidates it immediately. Strict empty JSON, 4096-byte bodies, 2000 requests/minute.
Authorization
HostedGatewayTcpBrokerAuth Internal service only: the dedicated HOSTED_GATEWAY_TCP_BROKER_TOKEN, at least 48 characters. Route credentials, organization API keys, account sessions and the worker token are never accepted. Never distribute this bearer to a customer or public SDK.
In: header
Request Body
application/json
Response Body
application/json
curl -X POST "https://example.com/v1/internal/gateway/tcp/health" \ -H "Content-Type: application/json" \ -d '{}'{ "transport": "agentsafe-tcp-relay/1", "ready": true}Broker only: release a TCP lease and connector presence POST
Internal broker only; excluded from public SDK methods. Works while the feature is disabled. Idempotently release a missing lease; an existing lease requires its matching opaque token. This does not disable a route or authorize traffic. Strict JSON, 4096-byte bodies, 2000 requests/minute.
Default off, worker only: provision a queued TCP route POST
Internal worker only; excluded from public SDK methods. Default off. Identifier-only job, no target or organization selected by the caller. Use the organization's reserved domain and probe only its fixed HTTPS /_agentsafe/tcp/capabilities endpoint. Require transport:agentsafe-tcp-relay/1 and ready:true. Redirects and unexpected responses fail closed. This does not require or activate an HTTPS upstream. Strict empty JSON, at most 1024 bytes.