Claude Platform Docs

Archive Tunnel Certificate

$client->beta->tunnels->certificates->archive(string certificateID, string tunnelID, ?list<AnthropicBeta> betas, ?string workspaceID): TunnelCertificate
POST/v1/tunnels/{tunnel_id}/certificates/{certificate_id}/archive
Requires anthropic-beta: mcp-tunnels-2026-06-22. How to send beta headers

The Tunnels API is in research preview. It requires the anthropic-beta: mcp-tunnels-2026-06-22 header and may change without a deprecation period. It supersedes the Admin API endpoints at /v1/organizations/tunnels, which remain available during a migration window.

Archives a tunnel certificate, removing it from the set Anthropic trusts for the tunnel. The certificate record is retained. Archiving the last non-archived certificate is permitted; the tunnel rejects MCP traffic until a new certificate is added.

Parameters
tunnelID: string⁠Path parameter

ID of the tunnel (tnl_...).

certificateID: string⁠Path parameter

ID of the certificate to archive (tcrt_...).

betas?: optional list<AnthropicBeta>⁠Header parameter

This endpoint is in beta: requests must send mcp-tunnels-2026-06-22 in this header.

workspaceID?: optional string⁠Header parameter

Optional header to select the Workspace for this request. The value is a Workspace ID (for example, wrkspc_011CZkZaBF1tNoB5wlCeusgy).

Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace.

Returns
class TunnelCertificate { $type = 'tunnel_certificate'; $id; $archivedAt; /* 4 more */ }
"tunnel_certificate" type
string id

Unique identifier for the certificate, prefixed with tcrt_.

?\Datetime archivedAt

RFC 3339 datetime string indicating when the certificate was archived. Null if it is still in the trusted set.

\Datetime createdAt

RFC 3339 datetime string indicating when the certificate was registered.

?\Datetime expiresAt

RFC 3339 datetime string indicating when the certificate expires, or null if it does not expire.

string fingerprint

Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

string tunnelID

ID of the tunnel the certificate is registered against.

Archive Tunnel Certificate
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaTunnelCertificate = $client->beta->tunnels->certificates->archive(
  'certificate_id',
  tunnelID: 'tunnel_id',
  betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24],
  workspaceID: 'wrkspc_011CZkZaBF1tNoB5wlCeusgy',
);

var_dump($betaTunnelCertificate);
Returns Examples
Response 200
{
  "id": "id",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "created_at": "2019-12-27T18:11:19.117Z",
  "expires_at": "2019-12-27T18:11:19.117Z",
  "fingerprint": "fingerprint",
  "tunnel_id": "tunnel_id",
  "type": "tunnel_certificate"
}