Fibmesh Outbound / CLI & API
Inspect the profile.
Verify the route.
The development CLI lists egress profiles. The API defines separate creation, enable and disable operations. A recorded change still needs a working exit and a real traffic test.
Read the implemented command Development CLI & API reference · Confirm platform and deployment support during assisted setup.Available with assisted setup. Confirm the supported platform, source address and full-tunnel policy before connecting.
01 / Development command
List the records.
Know the boundary.
fibmesh egress list is the only implemented egress command, with text or JSON output. Creation, enable and disable mutation commands are not implemented. The login command is also a pending implementation.
These are development tools and contract references. They are not a production installation or authenticated signup guide.
fibmesh egress list --format text
fibmesh egress list --format jsonRequests GET /v1/egress-profiles
- Profile list
- Administrative records. No tunnel or source-address test.
fibmesh statusfibmesh diagnostics- Local identity and cached-policy information. No live route test.
02 / API operations
Read the operation.
Then read its effect.
The contract defines four authenticated user operations. HTTP success and administrative state each need careful interpretation.
On a narrow screen, scroll the table sideways to read the full endpoints and effects.
| Operation / endpoint | Response | Administrative effect |
|---|---|---|
ListGET /v1/egress-profiles | Profile records | Returns the profiles for the authorised organisation. |
CreatePOST /v1/egress-profiles | 201 · Created | Creates an initially disabled record. It does not provision an exit gateway or allocate a public source. |
EnablePOST /v1/egress-profiles/{id}/enable | 202 · Accepted | Accepts the state change and disables other profiles in the organisation. Verify applied policy and delivery separately. |
DisablePOST /v1/egress-profiles/{id}/disable | 202 · Accepted | Accepts the state change. Verify native route restoration on the actual platform. |
What the record says
A saved profile
is one observation.
Creation does not provision an exit. gateway_node_id and assigned_public_ip may be empty. An active or enabled record describes administrative state.
What delivery requires
A real request
is another.
Confirm an assigned, working exit, the endpoint’s applied policy and execution result, then test the destination from the actual application. Verify its source, DNS and each IP family.
Neither a record nor HTTP acceptance proves that internet traffic reaches a destination.
03 / Names in the contract
Four mode identifiers.
One full-tunnel intent.
These are API IDs within Outbound, not separate public products. Match the requested mode to the agreed service and assigned delivery.
- Required
name+mode- Optional
region- Not accepted by create
- Application selector, destination list or per-device exit binding.
secure_internet- Internet routing through a Fibmesh exit
Confirm the supported platform, assigned exit and actual traffic behaviour.
regular_vpn- Regular exit routing
No fixed or exclusive source address is implied.
stable_ip- A recognised outgoing source
Agree the assigned address, continuity and retention terms.
dedicated_ip- Exclusive outgoing identity
Confirm allocation, exclusivity and commercial scope.
The current policy builder requests full-tunnel routing for every mode, including 0.0.0.0/0 and ::/0. That does not certify working IPv6 delivery or eliminate operating-system exceptions. Verify both families and effective routes on the supported platform.
Enabling selects one active exit for the organisation and disables its other profiles. These operations do not provide per-user region switching or simultaneous per-device exits.
04 / Automation & recovery
Bound the wait.
Keep a way back.
Start with the organisation and the intended change. Establish supported authentication and delivery before depending on an automated workflow.
Read the current state
Identify the organisation, existing profiles and active exit before writing. Enabling selects one organisation-wide profile; avoid replacing another team’s exit unexpectedly.
Reconcile the response
Record the returned profile ID. If a create call times out, inspect existing records before retrying: these operations do not establish an idempotency-key contract.
Wait for applied delivery
Confirm the assigned gateway and source, then the affected endpoint’s new policy and execution result. Use a bounded wait with a clear failure outcome; never poll indefinitely for assumed success.
Test, disable and recover
Test the actual destination’s observed source, application response, DNS and IPv4/IPv6 behaviour. Exercise the agreed disable and recovery procedure, then verify ordinary routing with a fresh connection.
Keep endpoint private keys local and redact tokens, keys and other secrets from logs. Never put hosted database credentials or service-role keys in a customer CLI or browser.
For a supported deployment
Bring the workload.
Agree the operating path.
Share the platform, intended exit, source-address needs and automation requirements. Confirm the supported environment, access and recovery procedure with Fibmesh during assisted setup.