> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dbhost.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Direct migration connection

> Reserve, inspect and revoke a short-lived direct TLS connection for managed database migrations.

The direct migration channel is available only when enabled for a managed v4
database. All routes require a scoped API key for that database. Responses
have `Cache-Control: no-store`; metadata never includes a password.

| Method | Path | Result |
| - | - | - |
| `GET` | `/api/v1/databases/{id}/connection-profiles/migration` | Latest lease metadata, status, exact IPs, limits and endpoint when active. |
| `POST` | Same path | Reserve a lease; send a stable `Idempotency-Key`. Returns 202 until operator activation. |
| `POST` | `.../migration/credentials` | Return the password to an owner-scoped, mutating API key only while the exact lease is active and unexpired. |
| `DELETE` | Base path | Cancel an unused reservation or disable the SQL login and request network-rule cleanup. |

`POST` accepts only `allowedAddresses` (one or two exact public IPv4/IPv6
addresses), `ttlMinutes` (10–120), `connectionLimit` (1 or 2),
`statementTimeoutMs` (60000–1800000) and `lockTimeoutMs` (1000–30000, less
than the statement timeout). The server canonicalizes the IPs and verifies
the current physical database OID, role-set generation and owner OID before
it stores the request. The operator checks the global direct slot before
native preparation. Pending reservations do not
consume the direct-connection slot. An operator prepares and activates one
lease at a time across the cluster in the first release.

The active endpoint uses `migrate.dbhost.app:5432` with `sslmode=verify-full`.
The runtime connection continues to use PgBouncer. `DELETE` can return
`revoking` while the operator removes only that lease's HBA, host and cloud
allowlist. A new request cannot bypass this reconciliation. A 404
`FEATURE_NOT_AVAILABLE` means the channel is not enabled; a 409 means the
exact physical or provider state needs reconciliation before access opens.

For tool setup and expiry behavior, see [Direct database migrations](/guides/direct-migrations).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.