Update a tunnel
⚠️
Preview — this feature is being built; the design below is the spec.
PATCH https://app.syntic.ai/v1/tunnels/{tunnel_id}Change a tunnel’s targets, description or state. New allowed_targets are pushed to connected connectors within 30 seconds. Setting status: disabled closes every connection; requests that use the tunnel then fail with 502 tunnel_unavailable until it is enabled again.
For how this fits into a full workflow, see MCP tunnels.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <key>: a private inference key (sk_live_...). See Authentication. |
syntic-beta | Yes, while in preview | mcp-tunnels-2026-12-01. Without it the call fails with 400 beta_required. See Versioning. |
Content-Type | Yes | application/json |
Path parameters
| Parameter | Type | Description |
|---|---|---|
tunnel_id | string | The tunnel id, starting with tnl_. |
Body parameters
| Parameter | Type | Required | Notes |
|---|---|---|---|
allowed_targets | array of strings | No | Replaces the list. |
description | string | No | |
status | string | No | enabled or disabled. |
Response
200 OK, Content-Type: application/json
{
"id": "tnl_01JCE4G6J8L0N2Q4S6U8",
"type": "tunnel",
"name": "erp-onprem",
"description": "On-prem ERP MCP server",
"workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
"allowed_targets": [
"http://erp-mcp.internal:8080/mcp",
"http://hr-mcp.internal:8081/mcp"
],
"auth_mode": "token",
"status": "connected",
"connections": {
"active": 2,
"last_seen_at": "2026-11-05T10:00:31Z"
},
"region": "eu",
"created_at": "2026-10-28T09:00:00Z",
"updated_at": "2026-10-28T09:00:00Z"
}| Field | Type | Description |
|---|---|---|
id | string | Starts with tnl_. Use it as tunnel_id on an MCP server entry. |
allowed_targets | array | The only URLs inside your network the connector will forward to. Anything else is refused by the connector itself. |
auth_mode | string | How connectors prove who they are: token (connector token) or mtls (client certificate from this tunnel’s certificates). |
status | string | connected when at least one connector is online, disconnected otherwise, disabled when turned off. |
connections | object | How many connector instances are online and when one last checked in. |
Examples
curl -sS -X PATCH "https://app.syntic.ai/v1/tunnels/tnl_01JCE4G6J8L0N2Q4S6U8" \
-H "Authorization: Bearer $SYNTIC_API_KEY" \
-H "syntic-beta: mcp-tunnels-2026-12-01" \
-H "Content-Type: application/json" \
-d '{
"allowed_targets": [
"http://erp-mcp.internal:8080/mcp",
"http://hr-mcp.internal:8081/mcp"
]
}'Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 404 | not_found_error | tunnel_not_found | No tunnel with this id in the key’s workspace. |
| 401 | authentication_error | invalid_api_key | The key is missing, unknown, revoked or expired. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Was this page helpful?