Use Your Central Agent URL

A connected gateway can take requests from anywhere through your agent's published HTTPS URL, even on a laptop behind a router. The gateway keeps an outbound connection open to Verdictan, called the relay, and requests to the agent URL arrive over it. You don't open or forward any inbound port. The gateway just has to keep running.

Select the correct address

Address	Use it for
The published agent URL, copied from the Console	Requests from any machine, through Verdictan to the connected gateway
http://127.0.0.1:41002	Requests from the gateway's own machine, straight to its local listener

127.0.0.1 always means the machine sending the request, so it never reaches your laptop from another computer.

Send a request through the relay

Use the same agent, gateway, model, and application token as your finished quickstart.

1. In the Console, open Agents, open your agent, and select the hostname button to copy its published hostname.

2. In a second terminal, set:

   export VERDICTAN_AGENT_URL='https://YOUR_PUBLISHED_HOSTNAME'
   export VERDICTAN_CLIENT_TOKEN='YOUR_APPLICATION_TOKEN'
   export VERDICTAN_MODEL='YOUR_CONFIGURED_MODEL'

   Leave /v1 off the agent URL.

3. Send a request:

   curl --fail-with-body -sS "$VERDICTAN_AGENT_URL/v1/chat/completions" \
     -H "Authorization: Bearer $VERDICTAN_CLIENT_TOKEN" \
     -H 'Content-Type: application/json' \
     -d @- <<JSON
   {
     "model": "$VERDICTAN_MODEL",
     "messages": [{"role": "user", "content": "Say hello in one sentence."}],
     "stream": false
   }
   JSON

The reply is in choices[0].message.content, and its decision and usage appear in the Console. Relay requests get the same policies and application-token checks as local ones. A recent gateway heartbeat doesn't prove public requests work; this request does.

Check streaming

Add -N to curl and set "stream": true. Chat Completions streaming sends data: events and ends with data: [DONE]. Output policies may hold the whole response before sending any events; a passthrough-compatible chain sends tokens as they arrive. See Streaming and SSE.

Connection requirements

The relay starts on its own when the connected gateway has:

Variable	Meaning
VERDICTAN_API_URL	The control-plane endpoint
VERDICTAN_API_TOKEN	This gateway's runtime token
VERDICTAN_RUNTIME_REGISTRATION_ID	Its runtime registration ID

The Console's setup command provides all three. The registration ID can also come from --runtime-registration-id, or from a registration restored at startup.

Allow outbound HTTPS and secure WebSocket traffic on port 443 to the API and relay hosts. The relay forwards each request to the gateway's local port, usually 41002.

Relay endpoints and reconnect behavior

The gateway works out the relay endpoint from VERDICTAN_API_URL: it swaps a leading api. for relay., switches to wss://, and appends /v1/gateway/relay. A hostname without api. is used as is.

API URL	Relay URL
https://api.eu.verdictan.com	wss://relay.eu.verdictan.com/v1/gateway/relay
https://api.us.verdictan.com	wss://relay.us.verdictan.com/v1/gateway/relay

To use a different relay host, set VERDICTAN_RELAY_URL, for example https://relay.internal:9443. The gateway converts https:// to wss:// and appends /v1/gateway/relay. Include the scheme: a value without one connects over unencrypted ws://.

The gateway authenticates with its runtime token and registers its runtime ID. Once acknowledged, it forwards incoming requests to its local listener and sends responses back over the same connection.

Behavior	Timing
Reconnect after a registered connection closes	1 second
Retry before registration completes	Increasing, up to 30 seconds
Ping	Every 20 seconds
Reconnect with no WebSocket message	After 45 seconds
Timeout for each relayed local request	30 seconds

Check the connection

Check	What it tells you
The gateway's heartbeat in the Console	The runtime recently reached the control plane
relay client: registered, listening for requests in the gateway log	The relay registered at that moment
A request through the published URL	The public route reaches the gateway and returns a result

The Console has no relay status field, and verdictan gateway status reports only the local service, not the public route.

If the request fails

Symptom	What to check
No published hostname	Link a gateway to the agent and deploy its configuration.
The relay keeps failing to connect	VERDICTAN_API_URL (or VERDICTAN_RELAY_URL), DNS, and outbound HTTPS and WSS access to the relay host
Registration fails	The runtime registration ID, and the runtime token's permissions, expiry, and revocation
Local requests work, public ones fail	The agent's published binding, and relay registration lines in the gateway log
Public requests are slow or time out	Provider response time, network timing, and the 30-second relay request timeout

Next steps

• verdictan gateway run: configure the connected runtime.
• verdictan gateway: run the gateway as a service.
• Investigate a Blocked Request: read a policy decision once requests get through.