Deploy an App with TCP using the Application Manager API | MuleSoft Documentation
# Deploy an App with TCP using the Application Manager API
To configure protocols other than HTTP or HTTPS, first set up TCP inbound firewall rules to allow TCP traffic for your private space. You can then use the Application Manager API to deploy an app using TCP. TCP inbound firewall rules do not support custom endpoints.
To configure firewall rules using TCP, follow the steps in Configure Firewall Rules and select TCP.
## Before You Begin
Configure the following network-level rules for the firewall in your private space:
  * An ingress rule: `Allow TCP` on the port range `30500-32500`.
  * An egress rule: `Allow HTTP/HTTPS` to `Any Destination`. If you must restrict outbound traffic, configure `Allow TCP` to `Any Destination` on the port `<application-port>` as a rule.


## Find Available Ports for Your App
The port range for TCP is between 30500 to 32500. To confirm port availability, use the CloudHub 2.0 API that returns a list of available ports.
The following examples show the API request and response when you use it to find available ports:
Request:
```
GET
https:/anypoint.mulesoft.com/runtimefabric/api/organizations/{organizationId}/privatespaces/{privatespaceId}/ports?available=true&count=10
```

In the request, the `available` parameter provides unused ports in the response. The `count` parameter lets you specify the number of ports, between 1 and 10. The actual availability of ports limits the end result.
Response:
```
{
  "ports": [
    30500,
    30501,
    30502,
    30503,
    30504,
    30511,
    30512,
    30513,
    30514,
    30515
  ]
}
```

## Deploy an App Using the Application Manager API
In the Application Manager API, use the `tcp` section under `deploymentSettings` to map your TCP port and deploy your app. The mapping uses the external port to expose `portNumber` and the app level-defined port `applicationPortNumber`. You can configure up to 10 ports per application.
The following example shows the request to deploy a new app using a TCP port mapping:
```
POST https://anypoint.mulesoft.com/amc/application-manager/api/v2/organizations/{organizationId}/environments/{environmentId}/deployments
{
 "name": "logs-app-uc01",
 "labels": [
  "beta"
 ],
 "target": {
  "provider": "MC",
  "targetId": "cfe2157f-438b-4fb8-81fe-13ec89c55545",
  "deploymentSettings": {
   "clustered": false,
   "enforceDeployingReplicasAcrossNodes": false,
//------------------------------------NEW-------------------------------------
   "tcp": {
     "inbound": {
      "ports": [
       {
        "portNumber": 30500,
        "applicationPortNumber": 9000
       },
       {
        "portNumber": 30501,
        "applicationPortNumber": 9001
       },
       {
        "portNumber": 30502,
        "applicationPortNumber": 9002
       },
      ]
     }
    },
//------------------------------------NEW-------------------------------------
   "jvm": {},
   "runtimeVersion": "4.4.0:20220523-1",
   "updateStrategy": "rolling",
   "disableAmLogForwarding": false,
   "generateDefaultPublicUrl": true
  },
  "replicas": 1
 },
 "application": {
  "ref": {
   "groupId": "66310c16-bce5-43c4-b978-5945ed2f99c5",
   "artifactId": "app-with-40-schedulers",
   "version": "1.0.5",
   "packaging": "jar"
  },
  "assets": [],
  "desiredState": "STARTED",
  "configuration": {
   "mule.agent.application.properties.service": {
    "applicationName": "logs-app-uc01",
    "properties": {},
    "secureProperties": {}
   },
   "mule.agent.logging.service": {
    "artifactName": "logs-app-uc01",
    "scopeLoggingConfigurations": []
   }
  },
  "integrations": {
   "services": {
    "objectStoreV2": {
     "enabled": false
    }
   }
  },
  "vCores": "0.05"
 }
}
```

Deployments that include unavailable ports fail. Successful deployments use the newly mapped ports, and those ports become unavailable. If the app is deleted, the ports become available again.
## Update an App Using the Application Manager API
Using the Application Manager API, change the `tcp` mapping in the `deploymentSettings` section to update the TCP port, and then redeploy the app.
The following example shows a request to update an existing app and its body with a new TCP mapping:
```
PATCH
https://anypoint.mulesoft.com/amc/adam/api/organizations/{organizationId}/environments/{environmentId}/deployments/{deploymentId}
{
  "id": "id",
  "target": {
   "provider": "MC",
   "targetId": "873a9879-cca7-4211-b90e-826e98123929",
   "deploymentSettings": {
    "tcp": {
     "inbound": {
      "ports": [
       {
        "portNumber": 30507,
        "applicationPortNumber": 9007
       },
       {
        "portNumber": 30508,
        "applicationPortNumber": 9008
       },
       {
        "portNumber": 30509,
        "applicationPortNumber": 9009
       }
      ]
     }
    }
   }
  }
 }
```

Updates that include unavailable ports fail. Successful deployments occupy the newly mapped ports, and those ports become unavailable. The ports that you replaced with new mappings become available.
## Access Your TCP App
  * You can access the app using VPN or a transit gateway and within the private space. Because the apps run on worker nodes, you can’t access them directly over the internet. TCP endpoints use wildcard domains. The app-name or prefix is irrelevant. You can access applications on the endpoint: `*.<domain>.<region>.tcp.cloudhub.io:<port>`.
A sample URL is `mllp-app-2-mpskt5.q8b5lv.usa-e2.tcp.cloudhub.io:30500`.
  * You can’t establish a connection directly to the TCP URL, such as: `corvette-azeiuc.internal-yvs7m6.usa-w1.tcp.cloudhub.io.".`
The TCP URL format has the structure: {application-url}.{environment}.tcp.cloudhub.io:{port}. You can’t add "internal-" to the {environment}, as CloudHub 2.0 doesn’t support internal endpoints for TCP applications.