Tether
DocsGitHub

API reference

Tool endpoint

The address of the server that runs your tools. Tether posts a signed request to it whenever a tool that has no http binding is called or a write is confirmed. Setting it is the step that makes a registered catalog usable. Tenant secret key only.

Set it

PUT /v1/endpoint

curl -X PUT $TETHER_URL/v1/endpoint \
  -H "X-Api-Key: $TETHER_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://tools.yourcompany.com/tether" }'

{ "configured": true, "url": "https://tools.yourcompany.com/tether", "signingSecretIssued": true }

The address must be absolute and HTTPS, and it passes the same address checks as every outbound call, so private and loopback addresses are refused. Surrounding spaces are trimmed. The CLI does this for you: tether register sets the endpoint from tether.config.json before it registers the catalog.

An address that fails answers 400 and changes nothing:

{ "error": "invalid_endpoint", "message": "Endpoint must use HTTPS." }

The other message you will meet is Endpoint is not an absolute URL.

Clear it

Clearing is explicit. Send an empty string or null:

curl -X PUT $TETHER_URL/v1/endpoint \
  -H "X-Api-Key: $TETHER_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "" }'

A body with no url at all, such as {} or a misspelled field name, answers 400 invalid_request and leaves the current endpoint in place, so a typo cannot take your tools offline.

Read it

GET /v1/endpoint

{ "configured": false, "url": null, "signingSecretIssued": true }

signingSecretIssued says a signing secret exists for the tenant. The secret itself was shown once, when the tenant was created, and is never returned again. Your endpoint verifies each request with it; see Verifying signatures.

When it is not set

A tool call that needs the endpoint gets No tool endpoint is configured for this tenant, followed by the call that sets one, as its result, and the model tells the user the lookup failed. Tools imported from an OpenAPI document or proxied from an MCP server do not use it; they call your API or your server directly.