> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# onAttach()

> `protected` **onAttach**(`_att`): `void` | `Promise`\<`void`>

Hook: a connection has been authorized and is about to be admitted.

Runs after [`authorize`](/docs/agent-sdk/interface/authorize) resolved the
connection's claims and before anything is sent to it. Inspect
`att.claims` (and `att.req`, the upgrade request carrying front-door
identity headers) and call `att.close(code?, reason?)` (or throw) to
veto: a vetoed socket is closed, receives no frames, and is never
counted in [`attachments`](/docs/agent-sdk/interface/attachments). The default
implementation admits every authorized connection.

**Parameters**

| Parameter | Type | Description |
| - | - | - |
| `_att` | [`Attachment`](/docs/agent-sdk/interface/onAttach#attachment) | The connection's claims, its upgrade request, and its `close`. |

**Returns**

`void` | `Promise`\<`void`>

## Attachment

One authorized client connection, as handed to `Agent.onAttach` (and to the
socket server's `onAttach` hook) right before the connection is admitted.

Inspect `claims` and call
`close` to veto the connection: a vetoed socket
is closed immediately, never admitted as a watcher, and receives no
protocol frames.

**Properties**

**claims**

> `readonly` **claims**: `ReadonlySet`\<[`Claim`](/docs/agent-sdk/interface/authorize#claim)>

The claims this connection was granted by the authorization policy.

***

**req?**

> `readonly` `optional` **req?**: `Request`

The connection's upgrade request, when the host provided one. Identity
headers stamped by an authenticating front door ride here, so a veto can
consider the caller's identity as well as its claims.

**Methods**

**close()**

> **close**(`code?`, `reason?`): `void`

Veto this connection: close the socket now. It is never admitted and
receives no frames.

**Parameters**

| Parameter | Type | Description |
| - | - | - |
| `code?` | `number` | WebSocket close code (application codes 4000-4999 are yours to define). Defaults to 1008 (policy violation). |
| `reason?` | `string` | Optional human-readable close reason. |

**Returns**

`void`