---
title: "Mint a fleet-scoped mablnet operator session (peer JOIN credential + operator-command token)"
method: POST
path: "/link/mablnet/authorize/operator/fleet"
tags: ["LinkMablnet"]
---

# Mint a fleet-scoped mablnet operator session (peer JOIN credential + operator-command token)

`POST /link/mablnet/authorize/operator/fleet`

Issues the same pair of short-lived signed artifacts as `/authorize/operator/tenant`, but for a **fleet** operator session — one that operates on the Link Router fleet itself (Router inventory, drain a Router) rather than a customer Host.
Both artifacts bind to the fleet sentinel workspace (`mabl`) rather than a customer workspace. The `peer_credential` is recognised locally by a Router's `OperatorTenantAuthenticator` (verified against the same KMS-held Ed25519 key, never resolved against a customer tunnel) and admits the operator to the Router's operator tenant; the `operator_token` carries the fleet scope set and is validated by the Router's `MablFleetOperatorAuthorizer`.
Auth: user-OAuth callers who are mabl **global admins only**. Fleet operations act across customers, so the support-admin diagnostic tier admitted by the tenant endpoint is deliberately excluded here.
Scope policy: global admins get the fleet scope set (`read:router-inventory`, `drain:router`, `write:log-level`). Callers do not request scopes — the api decides.
Lifetime: 30 minutes per issued session; callers re-fetch when needed.

## Request body

- MablnetFleetOperatorSessionRequest — Request body for `POST /link/mablnet/authorize/operator/fleet`. A fleet operator session operates on the Link Router fleet itself, not a customer tunnel, so it takes no `workspace_id` — both minted artifacts bind to the fleet sentinel workspace. The only field is an optional audit label; the api defaults it when absent.
  - `label` string — Optional audit / host-id readability label for the session (e.g. an incident id). Defaults server-side when omitted. Does not bind the session to any customer tunnel.
  - `infrastructure_key` string — The link infrastructure key of the cluster whose fleet this session operates (`mabl` when omitted — the shared cluster). The minted operator token carries it as its `infrastructure_key` claim, and a Router only accepts fleet tokens naming its own cluster — so operating a dedicated customer's fleet requires minting against that cluster's key.

## Response `200`

Fleet operator session minted successfully.

- MablnetOperatorSessionResponse — Result of a successful `POST /link/mablnet/authorize/operator/tenant` or `POST /link/mablnet/authorize/operator/fleet` call. Carries both artifacts the caller needs for one operator session: a peer JOIN credential and an operator-command token.
  - `peer_credential` string, byte, required — Base64 (standard alphabet, no URL safety) of the UTF-8 JSON bytes of the signed peer JOIN credential. The caller presents these bytes as the mablnet `HostCredentials` blob at JOIN; api's `/authorize/host` validates the Ed25519 signature and admits the user as a tenant peer.
  - `operator_token` string, byte, required — Base64 (standard alphabet, no URL safety) of the UTF-8 JSON bytes of the signed operator-command token. Carried per-request in `OperatorCommand.token` and validated by the customer Host's `MablOperatorAuthorizer`.
  - `expires_at` string, date-time, required — RFC 3339 timestamp marking when both artifacts expire. Fixed 30-minute window from issue time.

## Other responses

- `401` — User not authenticated
- `403` — Caller is authenticated but is not a mabl global admin.
- `default` — Unknown error

---

[API](https://skmtc.net/mabl/apis/mabl-api.md) · [All operations](https://skmtc.net/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mabl/mabl-api/revisions/d0fc0114da66/schema)