TSG HTTP data plane

The HTTP data plane executes provider HTTP transfers and proxies authorized requests to private backends. The control plane supplies the negotiated transfer and private asset configuration. Applications such as Dataspace Starter publish datasets through the control plane and obtain consumer access credentials.

Every worker verifies tenant-bound signaling and accepts only the explicit controlPlane.executionScopes owners. A worker can serve one or several tenants using the same configuration model. The control plane provisions tenant-local registrations; the worker never self-registers and has no participant or catalog management API.

Execution ownership stays fixed for a flow. An expiring execution lease bounds proxy access and refresh rotation, including after a worker restart. Global management requires an allowlisted human operator; tenant grants do not expose other tenants' flows or logs.

• Configuration describes accepted owners, authentication and runtime settings.
• HTTP flows traces signaling, proxy access and credential refresh.
• Data access credentials covers signing keys, lease expiry and migration.
• Modules maps the implementation to those responsibilities.
• Build process covers development and schema migrations.
• API reference lists the endpoints.
• Managed local sample shows organization provisioning and worker binding.

For deployment, see the TSG CLI and HTTP Helm chart.