Sign in
latestOpenAPI 3.0.32026-08-227451,2751.8 MB

d0fc0114da66

LinkMablnet

Mint a mablnet peer JOIN credential for an OAuth-authenticated user

Issues a single short-lived signed peer_credential the calling user presents at JOIN time to be admitted as a peer in a customer tenant. Unlike /authorize/operator/tenant, no operator-command token is minted — callers using this endpoint dial the customer's services (e.g., socks5 for test training) as regular intra-tenant peers; no operator-interface capabilities are involved. Auth: user-OAuth callers entitled to the tunnel's owner. For a workspace owner, a user with write access to the workspace — customer workspace members training against the workspace's SOCKS5 service, and mabl support admins where the workspace has enabled Support Access. For a company owner, a company admin or any member of the company; there is no standalone mabl global / support admin grant, because no company-level consent flag exists yet to gate one. For a user owner, that user alone. Lifetime: 30 minutes per issued credential. To keep a longer session alive without changing the bound Host identity, refresh by re-minting with the prior credential's host_id.

post/link/mablnet/authorize/peer

Request body

owner_type'workspace' | 'company' | 'user'

The kind of entity a mablnet tunnel is scoped to — its "owner". workspace is the classic scope: one tunnel per workspace. company scopes a single tunnel to an entire company, so every workspace under that company shares one mablnet tenant (and one Link Agent fleet) instead of needing a tunnel each. user is a personal tunnel scoped to a single user, private to that user — its egress is the user's own machine, used to route a cloud test run through it. All three are mablnet-only: legacy Link Tunnel is always workspace-scoped.

owner_idstring

The workspace id or company id (per owner_type) the user is joining.

workspace_idstring

Deprecated alias for a workspace owner (owner_type=workspace, owner_id=<workspace_id>). Prefer owner_type + owner_id.

labelstring required

Tunnel (Link Label) within the owner the user is joining.

host_idstring

Optional. When present the minted credential reuses this host_id rather than generating a fresh one, so a long-lived peer session can refresh its credential without changing the Host identity the Router has bound. Shape-only for the peer path — the credential's Ed25519 signature still binds it to the authorized (user, owner, label).

Response

Peer credential minted successfully.

peer_credentialstring byte required

Base64 (standard alphabet, no URL safety) of the UTF-8 JSON bytes of the signed peer JOIN credential. Same shape as the peer_credential returned from /authorize/operator/tenant.

expires_atstring date-time required

RFC 3339 timestamp marking when the credential expires. Fixed 30-minute window from issue time.