> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Lifecycle

> The statuses of a tunnel and its routes, from the first connected process to deletion.

| Status | Meaning |
| - | - |
| `inactive` | No tunnel process is connected. |
| `healthy` | One or more tunnel processes are connected. |
| `degraded` Preview | A tunnel process is connected but fails to reach its destinations. |

A new tunnel is `inactive`. It turns `healthy` when its first process connects, and `inactive` again when its last process stops. `telnyx-edge tunnel get` shows the status and the number of connected processes.

## Replicas

Any number of hosts can run the same token. Every process serves the same routes, [private services](https://developers.telnyx.com/docs/network/tunnel/features/private-services.md) Preview, and [public hostnames](https://developers.telnyx.com/docs/network/tunnel/features/public-hostnames.md) Preview. Telnyx spreads requests across the connected processes in turn. When one process stops, the next request goes via another, and no request fails. With `dc1-tunnel-a` stopped, the tunnel stays `healthy` on the one process left:

```bash Workstation theme={null}
telnyx-edge tunnel get chicago-dc
```

```text Output theme={null}
NAME         STATUS    CONNECTIONS
----------   -------   -----------
chicago-dc   healthy   1
...
```

A process whose connection drops reconnects on its own and serves again within seconds.

## Routes

| Status | Meaning |
| - | - |
| `pending` | Telnyx is installing the route on the *Network*. |
| `active` | The route carries traffic to its tunnel. |
| `inactive` | The route's tunnel has no connected process. |
| `failed` Preview | Telnyx could not install the route. |

A function on the [*Network*](https://developers.telnyx.com/docs/network/overview.md) picks up a route within about a minute of its creation. A route that is `inactive` turns `active` again when a process connects.

## Tunnel Token

The token is the only credential the tunnel process holds. Telnyx returns it once, when the tunnel is created or its token is rotated, and stores only a hash of it. `telnyx-edge tunnel get` and `telnyx-edge tunnel list` never print it.

The token lets a process serve the tunnel and nothing else. It is not an API key. The Telnyx API answers a request that carries it with `401 Unauthorized`, so a host that holds it cannot create, change, or delete resources.

[Rotating the token](https://developers.telnyx.com/api-reference/tunnels/rotate-a-tunnel-token.md) issues a new one and invalidates the old one:

```bash Workstation theme={null}
telnyx-edge tunnel rotate-token chicago-dc
```

```text Output theme={null}
Rotated token for tunnel chicago-dc (6afe50f3-bcff-48e9-93e8-4a906a91067e)
Token (shown once, store it now):
tnl_…
The previous token no longer works.
```

A process on the old token stays connected and keeps serving. When it reconnects, Telnyx refuses it, and the process exits:

```text Tunnel host theme={null}
Error: tunnel: token rejected (rotate-token issued a new one?)
```

## Deletion

A tunnel that a route names cannot be [deleted](https://developers.telnyx.com/api-reference/tunnels/delete-a-tunnel.md). `telnyx-edge tunnel delete` lists the routes instead:

```text Output theme={null}
Error: delete tunnel: tunnel 6afe50f3-bcff-48e9-93e8-4a906a91067e is the next hop of 1 route; delete it first: 38aa69b4-9a4a-4181-bb92-e1571cc14533
```

Once the tunnel is deleted, Telnyx refuses its token.