Default off, worker only: provision a queued TCP route
Internal worker only; excluded from public SDK methods. Default off. Identifier-only job, no target or organization selected by the caller. Use the organization's reserved domain and probe only its fixed HTTPS /_agentsafe/tcp/capabilities endpoint. Require transport:agentsafe-tcp-relay/1 and ready:true. Redirects and unexpected responses fail closed. This does not require or activate an HTTPS upstream. Strict empty JSON, at most 1024 bytes.
Authorization
HostedGatewayWorkerAuth Internal worker only: HOSTED_GATEWAY_WORKER_TOKEN, at least 32 characters. This grants processing of identifier-only provisioning jobs, never ticket redemption or lease renewal. Never distribute this bearer to a customer or public SDK.
In: header
Path Parameters
Saved resource UUID in the current workspace; also the TCP route UUID.
uuidRequest Body
application/json
Response Body
application/json
curl -X POST "https://example.com/v1/internal/gateway/tcp/routes/497f6eca-6276-4993-bfeb-53cbbbba6f08/process" \ -H "Content-Type: application/json" \ -d '{}'{ "status": "ready", "retry_after_seconds": 15}Broker only: prove control API authentication and database readiness POST
Internal broker only; excluded from public SDK methods. Requires the configured dedicated broker bearer and a successful database check. Works while HOSTED_GATEWAY_TCP_ENABLED is false; ready:true grants no traffic authority. The broker caches a successful probe at most 10 seconds and expires readiness proof after 30 seconds; authentication refusal invalidates it immediately. Strict empty JSON, 4096-byte bodies, 2000 requests/minute.
Read the exact current historical comparison policy GET
Default off; only a dedicated commerceConnectedTransport credential is admitted. Enabled automatic onboarding additionally requires accountSourceAuthority:true with orgIds omitted. This is not a generic wildcard org key. Each handler independently verifies fresh Accounts signed authority, exact resource/source/plan/tenant/revision and the synced projection before disclosing any result. Generic fixed-orgIds service keys keep their existing permissions. Requires the transient source proof header, at least one approved Walmart or Adobe source and an explicit nonzero or null history allowance. Reads the selected exact version; never chooses a default or writes policy.