| 方法 | 路径 | 摘要 | 认证 |
|---|---|---|---|
| GET | /v1/admin/admin-access-policy | Read the platform administration access allowlist | 登录会话 |
| PUT | /v1/admin/admin-access-policy | Save the platform administration access allowlist | 登录会话 |
契约文件：api/openapi/v1/control.yaml
/v1/admin/admin-access-policyRead the platform administration access allowlist
Requires system_configuration.read on the platform scope. current_ip is the client address the control plane resolved for this request.
| 状态码 | 说明 |
|---|---|
200 | Current policy (revision 0 and disabled when never saved). 字段： |
401 | 认证失败或会话已失效。 |
403 | 当前身份没有执行该操作的权限。 |
401 检查凭据格式、是否过期或被轮换。403 检查 Key 范围与所有者当前权限、当前租户作用域；不要换更高权限账号绕过。/v1/admin/admin-access-policySave the platform administration access allowlist
Requires system_configuration.manage on the platform scope. When enabled, platform-scope sign-in, refresh and every platform-scope session request must come from an allowed address or CIDR prefix; loopback is always allowed; tenant sessions and API keys are not affected. A policy that would not allow the saving request's own address is refused (422 admin_access_self_lockout). Recovery when locked out: run `control-api admin-access-allowlist disable` as root on the control host. Requests refused by the policy get 403 admin_access_denied.
application/json · 必填：是
| 名称 | 类型 | 必填 | 说明 |
|---|---|---|---|
expected_revision | integer(int64) | 是 | — |
enabled | boolean | 是 | — |
allowlist | array<string> | 是 | — |
| 状态码 | 说明 |
|---|---|
200 | Saved. 字段： |
400 | 请求体或参数不合法。 |
401 | 认证失败或会话已失效。 |
403 | 当前身份没有执行该操作的权限。 |
409 | 请求的状态与已有资源或幂等记录冲突。 |
422 | admin_access_self_lockout. |
400 按字段说明修正参数或请求体再发；不要原样重试。401 检查凭据格式、是否过期或被轮换。403 检查 Key 范围与所有者当前权限、当前租户作用域；不要换更高权限账号绕过。409 先回读资源当前状态；同一操作重试保持原 Idempotency-Key 和原请求内容。