The tunnel object

⚠️

Preview — this feature is being built; the design below is the spec.

The tunnel object as the API returns it. Every field below appears in every response that returns this object; fields with no value are null rather than missing.

Example

{
  "id": "tnl_01JCE4G6J8L0N2Q4S6U8",
  "type": "tunnel",
  "name": "erp-onprem",
  "description": "On-prem ERP MCP server",
  "workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
  "allowed_targets": [
    "http://erp-mcp.internal:8080/mcp"
  ],
  "auth_mode": "token",
  "status": "disconnected",
  "connections": {
    "active": 0,
    "last_seen_at": null
  },
  "region": "eu",
  "created_at": "2026-10-28T09:00:00Z",
  "updated_at": "2026-10-28T09:00:00Z",
  "connector_token": "stn_live_9QxF…redacted"
}

Fields

Field	Type	Description
`id`	string	Starts with `tnl_`. Use it as `tunnel_id` on an MCP server entry.
`type`	string	The object type, always `tunnel`.
`name`	string	Name shown in the Console and in reports.
`description`	string	Free-text description.
`workspace_id`	string	The workspace it belongs to.
`allowed_targets`	array	The only URLs inside your network the connector will forward to. Anything else is refused by the connector itself.
`auth_mode`	string	How connectors prove who they are: `token` (connector token) or `mtls` (client certificate from this tunnel’s certificates).
`status`	string	`connected` when at least one connector is online, `disconnected` otherwise, `disabled` when turned off.
`connections`	object	How many connector instances are online and when one last checked in.
`region`	string	Data region.
`created_at`	string	When it was created, RFC 3339 UTC (some older objects use Unix seconds).
`updated_at`	string	When it last changed.
`connector_token`	string	Starts with `stn_`. Pass it to the connector as `SYNTIC_TUNNEL_TOKEN`. Returned only here and by rotate.

Returned by

trust_rule tunnel_certificate

Was this page helpful?