diff --git a/controller/controller.go b/controller/controller.go
index e9fb28ae..932cb759 100644
--- a/controller/controller.go
+++ b/controller/controller.go
@@ -43,5 +43,5 @@ func Run(cfg *Config) error {
 }
 
 func versionHandler(_ metadata.VersionParams) middleware.Responder {
-	return metadata.NewVersionOK().WithPayload(&rest_model_zrok.Version{Version: "v0.0.1; sk3tch"})
+	return metadata.NewVersionOK().WithPayload(&rest_model_zrok.Version{Version: "v0.0.1; sk3tc4"})
 }
diff --git a/rest_client_zrok/tunnel/tunnel_client.go b/rest_client_zrok/tunnel/tunnel_client.go
new file mode 100644
index 00000000..0619aef4
--- /dev/null
+++ b/rest_client_zrok/tunnel/tunnel_client.go
@@ -0,0 +1,79 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package tunnel
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+)
+
+// New creates a new tunnel API client.
+func New(transport runtime.ClientTransport, formats strfmt.Registry) ClientService {
+	return &Client{transport: transport, formats: formats}
+}
+
+/*
+Client for tunnel API
+*/
+type Client struct {
+	transport runtime.ClientTransport
+	formats   strfmt.Registry
+}
+
+// ClientOption is the option for Client methods
+type ClientOption func(*runtime.ClientOperation)
+
+// ClientService is the interface for Client methods
+type ClientService interface {
+	Tunnel(params *TunnelParams, opts ...ClientOption) (*TunnelCreated, error)
+
+	SetTransport(transport runtime.ClientTransport)
+}
+
+/*
+  Tunnel tunnel API
+*/
+func (a *Client) Tunnel(params *TunnelParams, opts ...ClientOption) (*TunnelCreated, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewTunnelParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "tunnel",
+		Method:             "POST",
+		PathPattern:        "/tunnel",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &TunnelReader{formats: a.formats},
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*TunnelCreated)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for tunnel: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+// SetTransport changes the transport on the client
+func (a *Client) SetTransport(transport runtime.ClientTransport) {
+	a.transport = transport
+}
diff --git a/rest_client_zrok/tunnel/tunnel_parameters.go b/rest_client_zrok/tunnel/tunnel_parameters.go
new file mode 100644
index 00000000..566aa7fd
--- /dev/null
+++ b/rest_client_zrok/tunnel/tunnel_parameters.go
@@ -0,0 +1,148 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package tunnel
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
+)
+
+// NewTunnelParams creates a new TunnelParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewTunnelParams() *TunnelParams {
+	return &TunnelParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewTunnelParamsWithTimeout creates a new TunnelParams object
+// with the ability to set a timeout on a request.
+func NewTunnelParamsWithTimeout(timeout time.Duration) *TunnelParams {
+	return &TunnelParams{
+		timeout: timeout,
+	}
+}
+
+// NewTunnelParamsWithContext creates a new TunnelParams object
+// with the ability to set a context for a request.
+func NewTunnelParamsWithContext(ctx context.Context) *TunnelParams {
+	return &TunnelParams{
+		Context: ctx,
+	}
+}
+
+// NewTunnelParamsWithHTTPClient creates a new TunnelParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewTunnelParamsWithHTTPClient(client *http.Client) *TunnelParams {
+	return &TunnelParams{
+		HTTPClient: client,
+	}
+}
+
+/* TunnelParams contains all the parameters to send to the API endpoint
+   for the tunnel operation.
+
+   Typically these are written to a http.Request.
+*/
+type TunnelParams struct {
+
+	// Body.
+	Body *rest_model_zrok.TunnelRequest
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the tunnel params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *TunnelParams) WithDefaults() *TunnelParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the tunnel params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *TunnelParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the tunnel params
+func (o *TunnelParams) WithTimeout(timeout time.Duration) *TunnelParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the tunnel params
+func (o *TunnelParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the tunnel params
+func (o *TunnelParams) WithContext(ctx context.Context) *TunnelParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the tunnel params
+func (o *TunnelParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the tunnel params
+func (o *TunnelParams) WithHTTPClient(client *http.Client) *TunnelParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the tunnel params
+func (o *TunnelParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the tunnel params
+func (o *TunnelParams) WithBody(body *rest_model_zrok.TunnelRequest) *TunnelParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the tunnel params
+func (o *TunnelParams) SetBody(body *rest_model_zrok.TunnelRequest) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *TunnelParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+	if o.Body != nil {
+		if err := r.SetBodyParam(o.Body); err != nil {
+			return err
+		}
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
diff --git a/rest_client_zrok/tunnel/tunnel_responses.go b/rest_client_zrok/tunnel/tunnel_responses.go
new file mode 100644
index 00000000..bed68225
--- /dev/null
+++ b/rest_client_zrok/tunnel/tunnel_responses.go
@@ -0,0 +1,67 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package tunnel
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
+)
+
+// TunnelReader is a Reader for the Tunnel structure.
+type TunnelReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *TunnelReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 201:
+		result := NewTunnelCreated()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	default:
+		return nil, runtime.NewAPIError("response status code does not match any response statuses defined for this endpoint in the swagger spec", response, response.Code())
+	}
+}
+
+// NewTunnelCreated creates a TunnelCreated with default headers values
+func NewTunnelCreated() *TunnelCreated {
+	return &TunnelCreated{}
+}
+
+/* TunnelCreated describes a response with status code 201, with default header values.
+
+tunnel created
+*/
+type TunnelCreated struct {
+	Payload *rest_model_zrok.TunnelResponse
+}
+
+func (o *TunnelCreated) Error() string {
+	return fmt.Sprintf("[POST /tunnel][%d] tunnelCreated  %+v", 201, o.Payload)
+}
+func (o *TunnelCreated) GetPayload() *rest_model_zrok.TunnelResponse {
+	return o.Payload
+}
+
+func (o *TunnelCreated) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model_zrok.TunnelResponse)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
diff --git a/rest_client_zrok/zrok_client.go b/rest_client_zrok/zrok_client.go
index c7ecfde9..ae19e5e4 100644
--- a/rest_client_zrok/zrok_client.go
+++ b/rest_client_zrok/zrok_client.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/openziti-test-kitchen/zrok/rest_client_zrok/identity"
 	"github.com/openziti-test-kitchen/zrok/rest_client_zrok/metadata"
+	"github.com/openziti-test-kitchen/zrok/rest_client_zrok/tunnel"
 )
 
 // Default zrok HTTP client.
@@ -58,6 +59,7 @@ func New(transport runtime.ClientTransport, formats strfmt.Registry) *Zrok {
 	cli.Transport = transport
 	cli.Identity = identity.New(transport, formats)
 	cli.Metadata = metadata.New(transport, formats)
+	cli.Tunnel = tunnel.New(transport, formats)
 	return cli
 }
 
@@ -106,6 +108,8 @@ type Zrok struct {
 
 	Metadata metadata.ClientService
 
+	Tunnel tunnel.ClientService
+
 	Transport runtime.ClientTransport
 }
 
@@ -114,4 +118,5 @@ func (c *Zrok) SetTransport(transport runtime.ClientTransport) {
 	c.Transport = transport
 	c.Identity.SetTransport(transport)
 	c.Metadata.SetTransport(transport)
+	c.Tunnel.SetTransport(transport)
 }
diff --git a/rest_model_zrok/tunnel_request.go b/rest_model_zrok/tunnel_request.go
new file mode 100644
index 00000000..2d6ff96d
--- /dev/null
+++ b/rest_model_zrok/tunnel_request.go
@@ -0,0 +1,53 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package rest_model_zrok
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// TunnelRequest tunnel request
+//
+// swagger:model tunnelRequest
+type TunnelRequest struct {
+
+	// endpoint
+	Endpoint string `json:"endpoint,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this tunnel request
+func (m *TunnelRequest) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this tunnel request based on context it is used
+func (m *TunnelRequest) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *TunnelRequest) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *TunnelRequest) UnmarshalBinary(b []byte) error {
+	var res TunnelRequest
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}
diff --git a/rest_model_zrok/tunnel_response.go b/rest_model_zrok/tunnel_response.go
new file mode 100644
index 00000000..843ec4f8
--- /dev/null
+++ b/rest_model_zrok/tunnel_response.go
@@ -0,0 +1,50 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package rest_model_zrok
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// TunnelResponse tunnel response
+//
+// swagger:model tunnelResponse
+type TunnelResponse struct {
+
+	// service
+	Service string `json:"service,omitempty"`
+}
+
+// Validate validates this tunnel response
+func (m *TunnelResponse) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this tunnel response based on context it is used
+func (m *TunnelResponse) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *TunnelResponse) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *TunnelResponse) UnmarshalBinary(b []byte) error {
+	var res TunnelResponse
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}
diff --git a/rest_server_zrok/embedded_spec.go b/rest_server_zrok/embedded_spec.go
index 3cb6a350..eb3e5eb8 100644
--- a/rest_server_zrok/embedded_spec.go
+++ b/rest_server_zrok/embedded_spec.go
@@ -96,6 +96,31 @@ func init() {
         }
       }
     },
+    "/tunnel": {
+      "post": {
+        "tags": [
+          "tunnel"
+        ],
+        "operationId": "tunnel",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "$ref": "#/definitions/tunnelRequest"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "tunnel created",
+            "schema": {
+              "$ref": "#/definitions/tunnelResponse"
+            }
+          }
+        }
+      }
+    },
     "/version": {
       "get": {
         "tags": [
@@ -152,6 +177,25 @@ func init() {
         }
       }
     },
+    "tunnelRequest": {
+      "type": "object",
+      "properties": {
+        "endpoint": {
+          "type": "string"
+        },
+        "token": {
+          "type": "string"
+        }
+      }
+    },
+    "tunnelResponse": {
+      "type": "object",
+      "properties": {
+        "service": {
+          "type": "string"
+        }
+      }
+    },
     "version": {
       "type": "object",
       "properties": {
@@ -241,6 +285,31 @@ func init() {
         }
       }
     },
+    "/tunnel": {
+      "post": {
+        "tags": [
+          "tunnel"
+        ],
+        "operationId": "tunnel",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "$ref": "#/definitions/tunnelRequest"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "tunnel created",
+            "schema": {
+              "$ref": "#/definitions/tunnelResponse"
+            }
+          }
+        }
+      }
+    },
     "/version": {
       "get": {
         "tags": [
@@ -297,6 +366,25 @@ func init() {
         }
       }
     },
+    "tunnelRequest": {
+      "type": "object",
+      "properties": {
+        "endpoint": {
+          "type": "string"
+        },
+        "token": {
+          "type": "string"
+        }
+      }
+    },
+    "tunnelResponse": {
+      "type": "object",
+      "properties": {
+        "service": {
+          "type": "string"
+        }
+      }
+    },
     "version": {
       "type": "object",
       "properties": {
diff --git a/rest_server_zrok/operations/tunnel/tunnel.go b/rest_server_zrok/operations/tunnel/tunnel.go
new file mode 100644
index 00000000..587451b9
--- /dev/null
+++ b/rest_server_zrok/operations/tunnel/tunnel.go
@@ -0,0 +1,56 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package tunnel
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// TunnelHandlerFunc turns a function with the right signature into a tunnel handler
+type TunnelHandlerFunc func(TunnelParams) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn TunnelHandlerFunc) Handle(params TunnelParams) middleware.Responder {
+	return fn(params)
+}
+
+// TunnelHandler interface for that can handle valid tunnel params
+type TunnelHandler interface {
+	Handle(TunnelParams) middleware.Responder
+}
+
+// NewTunnel creates a new http.Handler for the tunnel operation
+func NewTunnel(ctx *middleware.Context, handler TunnelHandler) *Tunnel {
+	return &Tunnel{Context: ctx, Handler: handler}
+}
+
+/* Tunnel swagger:route POST /tunnel tunnel tunnel
+
+Tunnel tunnel API
+
+*/
+type Tunnel struct {
+	Context *middleware.Context
+	Handler TunnelHandler
+}
+
+func (o *Tunnel) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewTunnelParams()
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
diff --git a/rest_server_zrok/operations/tunnel/tunnel_parameters.go b/rest_server_zrok/operations/tunnel/tunnel_parameters.go
new file mode 100644
index 00000000..57b454a6
--- /dev/null
+++ b/rest_server_zrok/operations/tunnel/tunnel_parameters.go
@@ -0,0 +1,77 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package tunnel
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/validate"
+
+	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
+)
+
+// NewTunnelParams creates a new TunnelParams object
+//
+// There are no default values defined in the spec.
+func NewTunnelParams() TunnelParams {
+
+	return TunnelParams{}
+}
+
+// TunnelParams contains all the bound params for the tunnel operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters tunnel
+type TunnelParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: body
+	*/
+	Body *rest_model_zrok.TunnelRequest
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewTunnelParams() beforehand.
+func (o *TunnelParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer r.Body.Close()
+		var body rest_model_zrok.TunnelRequest
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			res = append(res, errors.NewParseError("body", "body", "", err))
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			ctx := validate.WithOperationRequest(context.Background())
+			if err := body.ContextValidate(ctx, route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = &body
+			}
+		}
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
diff --git a/rest_server_zrok/operations/tunnel/tunnel_responses.go b/rest_server_zrok/operations/tunnel/tunnel_responses.go
new file mode 100644
index 00000000..07c503a0
--- /dev/null
+++ b/rest_server_zrok/operations/tunnel/tunnel_responses.go
@@ -0,0 +1,58 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package tunnel
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
+)
+
+// TunnelCreatedCode is the HTTP code returned for type TunnelCreated
+const TunnelCreatedCode int = 201
+
+/*TunnelCreated tunnel created
+
+swagger:response tunnelCreated
+*/
+type TunnelCreated struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model_zrok.TunnelResponse `json:"body,omitempty"`
+}
+
+// NewTunnelCreated creates TunnelCreated with default headers values
+func NewTunnelCreated() *TunnelCreated {
+
+	return &TunnelCreated{}
+}
+
+// WithPayload adds the payload to the tunnel created response
+func (o *TunnelCreated) WithPayload(payload *rest_model_zrok.TunnelResponse) *TunnelCreated {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the tunnel created response
+func (o *TunnelCreated) SetPayload(payload *rest_model_zrok.TunnelResponse) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *TunnelCreated) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(201)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
diff --git a/rest_server_zrok/operations/tunnel/tunnel_urlbuilder.go b/rest_server_zrok/operations/tunnel/tunnel_urlbuilder.go
new file mode 100644
index 00000000..aab35fdd
--- /dev/null
+++ b/rest_server_zrok/operations/tunnel/tunnel_urlbuilder.go
@@ -0,0 +1,84 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package tunnel
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// TunnelURL generates an URL for the tunnel operation
+type TunnelURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *TunnelURL) WithBasePath(bp string) *TunnelURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *TunnelURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *TunnelURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/tunnel"
+
+	_basePath := o._basePath
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *TunnelURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *TunnelURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *TunnelURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on TunnelURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on TunnelURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *TunnelURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}
diff --git a/rest_server_zrok/operations/zrok_api.go b/rest_server_zrok/operations/zrok_api.go
index ee31208f..0d25aaf5 100644
--- a/rest_server_zrok/operations/zrok_api.go
+++ b/rest_server_zrok/operations/zrok_api.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/identity"
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/metadata"
+	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/tunnel"
 )
 
 // NewZrokAPI creates a new Zrok instance
@@ -51,6 +52,9 @@ func NewZrokAPI(spec *loads.Document) *ZrokAPI {
 		IdentityEnableHandler: identity.EnableHandlerFunc(func(params identity.EnableParams) middleware.Responder {
 			return middleware.NotImplemented("operation identity.Enable has not yet been implemented")
 		}),
+		TunnelTunnelHandler: tunnel.TunnelHandlerFunc(func(params tunnel.TunnelParams) middleware.Responder {
+			return middleware.NotImplemented("operation tunnel.Tunnel has not yet been implemented")
+		}),
 		MetadataVersionHandler: metadata.VersionHandlerFunc(func(params metadata.VersionParams) middleware.Responder {
 			return middleware.NotImplemented("operation metadata.Version has not yet been implemented")
 		}),
@@ -94,6 +98,8 @@ type ZrokAPI struct {
 	IdentityCreateAccountHandler identity.CreateAccountHandler
 	// IdentityEnableHandler sets the operation handler for the enable operation
 	IdentityEnableHandler identity.EnableHandler
+	// TunnelTunnelHandler sets the operation handler for the tunnel operation
+	TunnelTunnelHandler tunnel.TunnelHandler
 	// MetadataVersionHandler sets the operation handler for the version operation
 	MetadataVersionHandler metadata.VersionHandler
 
@@ -179,6 +185,9 @@ func (o *ZrokAPI) Validate() error {
 	if o.IdentityEnableHandler == nil {
 		unregistered = append(unregistered, "identity.EnableHandler")
 	}
+	if o.TunnelTunnelHandler == nil {
+		unregistered = append(unregistered, "tunnel.TunnelHandler")
+	}
 	if o.MetadataVersionHandler == nil {
 		unregistered = append(unregistered, "metadata.VersionHandler")
 	}
@@ -278,6 +287,10 @@ func (o *ZrokAPI) initHandlerCache() {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
 	o.handlers["POST"]["/enable"] = identity.NewEnable(o.context, o.IdentityEnableHandler)
+	if o.handlers["POST"] == nil {
+		o.handlers["POST"] = make(map[string]http.Handler)
+	}
+	o.handlers["POST"]["/tunnel"] = tunnel.NewTunnel(o.context, o.TunnelTunnelHandler)
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
 	}
diff --git a/specs/zrok.yml b/specs/zrok.yml
index e64194d1..0814c0fe 100644
--- a/specs/zrok.yml
+++ b/specs/zrok.yml
@@ -42,6 +42,21 @@ paths:
           description: account not found
         500:
           description: internal server error
+  /tunnel:
+    post:
+      tags:
+        - tunnel
+      operationId: tunnel
+      parameters:
+        - name: body
+          in: body
+          schema:
+            $ref: "#/definitions/tunnelRequest"
+      responses:
+        201:
+          description: tunnel created
+          schema:
+            $ref: "#/definitions/tunnelResponse"
   /version:
     get:
       tags:
@@ -83,6 +98,18 @@ definitions:
         type: string
       cfg:
         type: string
+  tunnelRequest:
+    type: object
+    properties:
+      token:
+        type: string
+      endpoint:
+        type: string
+  tunnelResponse:
+    type: object
+    properties:
+      service:
+        type: string
 
 produces:
 - application/zrok.v1+json