Gateway-only boundary
How Parix authorizes and routes customer requests without exposing TigerBeetle replicas.
Every customer database operation uses the Parix gateway path. Developer, Dedicated, Production, and Enterprise do not expose raw TigerBeetle replica addresses or a direct native-protocol connection as a product surface.
Request path
For the public TigerBeetle operation API, the current path is:
- A client calls the Parix HTTP endpoint.
web-appauthenticates an API key or supported first-party OAuth token.- Parix verifies organization membership, credential scope, target database access, and required
db:readordb:writescope. - Plan and shared-database quota checks run where applicable.
- Parix resolves the database profile, provider, and region.
- The request is forwarded through the configured provider-specific gateway binding and tunnel path.
- The provider-local
tb-gatewayvalidates the internal request and performs the TigerBeetle operation.
The public operation route is:
POST /api/v1/databases/{databaseId}/tb/{operation}See TigerBeetle operations for supported operations and request bodies.
What customers can address
Customers address:
- the Parix application/API endpoint
- an organization and database identifier
- a supported operation
Customers do not receive:
- replica IP addresses
- provider-local gateway or tunnel addresses as application endpoints
- a raw TigerBeetle control-plane API
- a native TigerBeetle protocol route to replicas
Private health, tenant-routing, and signed provider routes are operator infrastructure, not public integration endpoints.
Authorization layers
Gateway-only routing does not replace credential scoping.
| Layer | Question it answers |
|---|---|
| User/session | Is this a signed-in Parix account? |
| Organization membership | Does the user or referenced key owner still belong to the organization? |
| API key metadata | Is the key organization-wide or bound to this database? |
| API scope | Does the credential include the required read or write scope? |
| Plan enforcement | Is this operation and request volume allowed for the database plan and status? |
| Provider routing | Which configured gateway path owns this database? |
Use a database-scoped key even though every request passes through the gateway. The gateway is a routing and enforcement boundary, not a substitute for least privilege.
Explicit non-guarantees
This page documents the supported customer access boundary. It does not establish or promise:
- a particular encryption-at-rest implementation
- customer VPC peering, PrivateLink, or another private-ingress product
- a compliance certification
- cross-region availability
- a contractual retention or recovery objective
Those properties must be documented by the applicable product capability or customer contract. See Providers and regions for currently exposed deployment choices.