---
title: "Mint a tenant-scoped mablnet operator session (peer JOIN credential + operator-command token)"
method: POST
path: "/link/mablnet/authorize/operator/tenant"
tags: ["LinkMablnet"]
---

# Mint a tenant-scoped mablnet operator session (peer JOIN credential + operator-command token)

`POST /link/mablnet/authorize/operator/tenant`

Issues two short-lived signed artifacts the calling user needs to drive a mablnet operator session against a specific customer workspace:
1. A `peer_credential` — an Ed25519-signed blob the operator presents at JOIN time to be admitted as a peer in the customer's tenant. The api's `/authorize/host` endpoint recognises `role: "peer"` and validates the signature in lieu of an api_key check.
2. An `operator_token` — an Ed25519-signed blob carried per-request in `OperatorCommand.token`. The customer Host's `MablOperatorAuthorizer` validates the signature, checks the embedded `workspace_id` matches the Host's own workspace, and verifies the requested capability's required scope is in the granted scope list.
Both artifacts bind to one customer workspace (the `workspace_id` request parameter) so a leaked credential cannot cross tenant boundaries. The mabl-deployment private key is held in Cloud KMS; the api never sees the bytes. For operating on the Router fleet itself (not a customer Host), use `/authorize/operator/fleet`.
Auth: user-OAuth callers only — operator tokens are an interactive support / engineering capability, not a workspace-scoped API. Requires **both** the mabl support-admin claim **and** access to the tunnel, because the two answer different questions. Tunnel access — a user who can modify the workspace (owner, editor, or a support admin where the workspace has enabled Support Access), a company member for a company-owned tunnel, or the owner of a personal tunnel — is what `/authorize/peer` asks on its own, since minting a peer credential for test training is ordinary. The token minted here instead carries `drain:host`, carrier recycle/disconnect and fault injection, so consent gates the reach and the support-admin role gates the capability. The mabl global-admin claim administers mabl's own resources and grants nothing here.
Scope policy: every admitted caller gets the whole tenant scope catalog — every `read:*`, `probe:destination`, the `recycle:carrier` / `disconnect:carrier` / `drain:host` mutations, and the diagnostic + fault-injection `start:*` / `stop:*` activities. Reaching the tunnel is the access control; there is no tier behind it. Callers do not request scopes — the api decides.
Lifetime: 30 minutes per issued session; callers re-fetch when needed.

## Request body

- MablnetOperatorSessionRequest — Request body for `POST /link/mablnet/authorize/operator/tenant`. Specifies which tunnel the operator session targets. Both minted artifacts (peer credential + operator token) bind to this `(owner_type, owner_id, label)` tunnel, which maps to one mablnet tenant.
  - `owner_type` 'workspace' | 'company' | 'user', required — The kind of entity a mablnet tunnel is scoped to — its "owner". `workspace` is the classic scope: one tunnel per workspace. `company` scopes a single tunnel to an entire company, so every workspace under that company shares one mablnet tenant (and one Link Agent fleet) instead of needing a tunnel each. `user` is a personal tunnel scoped to a single user, private to that user — its egress is the user's own machine, used to route a cloud test run through it. All three are mablnet-only: legacy Link Tunnel is always workspace-scoped.
  - `owner_id` string, required — The workspace id or company id (per `owner_type`) the session operates on.
  - `label` string, required — Tunnel (Link Label) within the owner the operator session targets.

## Response `200`

Operator session minted successfully.

- MablnetOperatorSessionResponse — Result of a successful `POST /link/mablnet/authorize/operator/tenant` or `POST /link/mablnet/authorize/operator/fleet` call. Carries both artifacts the caller needs for one operator session: a peer JOIN credential and an operator-command token.
  - `peer_credential` string, byte, required — Base64 (standard alphabet, no URL safety) of the UTF-8 JSON bytes of the signed peer JOIN credential. The caller presents these bytes as the mablnet `HostCredentials` blob at JOIN; api's `/authorize/host` validates the Ed25519 signature and admits the user as a tenant peer.
  - `operator_token` string, byte, required — Base64 (standard alphabet, no URL safety) of the UTF-8 JSON bytes of the signed operator-command token. Carried per-request in `OperatorCommand.token` and validated by the customer Host's `MablOperatorAuthorizer`.
  - `expires_at` string, date-time, required — RFC 3339 timestamp marking when both artifacts expire. Fixed 30-minute window from issue time.

## Other responses

- `401` — User not authenticated
- `403` — Caller is authenticated but is not authorized for the requested tunnel — not a mabl support admin, or the tunnel's owner has not granted them access.
- `default` — Unknown error

---

[API](https://skmtc.net/mabl/apis/mabl-api.md) · [All operations](https://skmtc.net/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mabl/mabl-api/revisions/d0fc0114da66/schema)