Send from where the API can be reached.
The API only answers the bastion's address. The staging network is private. The partner whitelisted one server. Via makes the request from that server: a tunnel item is an SSH login Sonda holds open, a request picks it next to Send, and the call leaves from there — with nothing installed on the box and no port opened on yours.
How it works
Pick it, test it, share the server but not the login.
A tunnel connects on demand at Send. A keepalive every 30 seconds; dropped after 45 without an answer, with the reason shown.
Test
Logs in and optionally reaches a host and port from the server, reporting the login and the reach in milliseconds. Nothing stays connected.
Status
Connected or not, the host key, the requests carried, the bytes, the last error. A chip on the answer says "made from this server through this tunnel".
In a shared project
The server, the port and the accepted host key travel with the project. The login — user, key, password — stays on each computer. Passwords and passphrases are masked, blank in exports, never echoed in errors.