Gets a link label

UUID for this Link Label

Time at which the Link Label was created

The link label

The globally unique name for this label that is safe to use in FQDNs (based on label and workspace ID).

The serialized X.509 certificate Link Agents use as their client identity on the legacy Link Tunnel mTLS path. Not used by mablnet: mablnet's HostCredentials are a separate JSON blob (workspace_id + label + host_id + issued_at + nonce); the mabl-deployment HostAuthenticator validates that blob via the POST /link/mablnet/authorize/host endpoint and maps it to mablnet_tenant_id. Also distinct from the per-Host peer QUIC certs mablnet's CertificateAuthority issues at join time, which embed (tenantId, hostId) in SAN OtherName extensions.

The serialized certificate for Link Servers to use

The fingerprint of the client certificate

The public key of the client certificate

The fingerprint of the server certificate

The public key of the server certificate

If specified, overrides the default Link Server image tag in this environment

The size of the Link Server, which determines its resource allocation

The time this was terminated at

The client id that terminated this link labe;l

The workspace that owns this label, for workspace-owned tunnels. Also the identity the legacy Link Tunnel path and the per-label mTLS certs are keyed by. Unset for company-owned tunnels (which are mablnet-only) — read owner_type/owner_id for the canonical scope.

The kind of entity a mablnet tunnel is scoped to — its "owner". workspace is the classic scope: one tunnel per workspace. company scopes a single tunnel to an entire company, so every workspace under that company shares one mablnet tenant (and one Link Agent fleet) instead of needing a tunnel each. user is a personal tunnel scoped to a single user, private to that user — its egress is the user's own machine, used to route a cloud test run through it. All three are mablnet-only: legacy Link Tunnel is always workspace-scoped.

The id of the owning entity — equals workspace_id for workspace tunnels, the company id for company tunnels.

The link infrastructure cluster this tunnel lives on, recorded for personal (user-owned) tunnels only. Server-derived at announce from the owner's workspace associations and folded into the label's identity (the label is a hash of machine_identity and this key), so a placement change produces a new tunnel rather than mutating this one. Absent on workspace- and company-owned labels — their placement always derives live from the owning company's link_infrastructure_key — and on personal labels announced before placement existed, which live on the shared cluster.

32-bit mablnet tenant identifier assigned at LinkLabel creation. Derived deterministically from a stable hash of <owner-key>:<label> — where <owner-key> is the workspace id for workspace tunnels and company:<company-id> for company tunnels — truncated into the 32-bit unsigned range, with a defensive collision check against existing LinkLabels — on the unlikely event the hash collides with an already-allocated tenant id, the value is offset (by 1 or a small random delta) until it lands in an unused slot. The chosen value is immutable for the lifetime of the LinkLabel. Used as the tenantId in mablnet's protocol. Populated lazily for legacy labels during the migration cutover; absent until the LinkLabel has been migrated or recreated. The legacy mablnet documentation calls this the "tenant id"; mabl's customer-facing name for the same concept is "Link label", and this field ties the two together.

Zero-padded 8-character lowercase hex form of mablnet_tenant_id, e.g. bee85e2b. Provided for log/grep/observability ergonomics; the numeric and hex forms always agree (both written in the same pass).