MethodPathSummaryAuth
GET/v1/admin/gateway-settingsTrusted CDN ranges and extra node entry points published to every GatewaySession
PUT/v1/admin/gateway-settingsReplace both lists (Gateways pick them up within a minute; audited)Session

Contract file:api/openapi/v1/control.yaml

Operation details

GET /v1/admin/gateway-settings

Trusted CDN ranges and extra node entry points published to every Gateway

operationId
getAgentGatewaySettings
Auth
  • Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
Required permissions

The contract has no separate permission annotation; see the description below and the 403 response.

Responses

getAgentGatewaySettings Responses
StatusDescription
200Settings. ETag is the content digest to send back in If-Match when saving.

Fields:trusted_proxies: array<object> entrypoints: array<object>

401Authentication failed or the session is invalid.
403The authenticated principal is not allowed to perform the action.

What to do on failure

  • 401 Check the credential format and whether it expired or was rotated.
  • 403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.

↑ Back to list

PUT /v1/admin/gateway-settings

Replace both lists (Gateways pick them up within a minute; audited)

operationId
updateAgentGatewaySettings
Auth
  • Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
Required permissions

The contract has no separate permission annotation; see the description below and the 403 response.

Description (from the contract)

Optimistic concurrency without a stored revision. If-Match must equal the ETag of the current settings (compared under the table lock); otherwise nothing is written and 409 gateway_settings_changed tells the page to reload.

Parameters

updateAgentGatewaySettings Parameters
NameInTypeRequiredDescription
If-MatchheaderstringYesETag returned by the GET (or the previous PUT) the form was loaded from.

Request body

application/json · Required:Yes

updateAgentGatewaySettings Request body
NameTypeRequiredDescription
trusted_proxiesarray<object>YesTrusted CDN back-to-origin ranges. Only Cloudflare is preset (CF-Connecting-IP); an empty header binds X-Forwarded-For.
entrypointsarray<object>YesExtra node entry points listed after the online Gateways, e.g. a CDN's 443 with transport ws.

Responses

updateAgentGatewaySettings Responses
StatusDescription
200Saved (normalized). ETag is the digest of the saved settings.

Fields:trusted_proxies: array<object> entrypoints: array<object>

409gateway_settings_changed (someone else saved since the form was loaded; reload and retry)
422invalid_input
428precondition_required (If-Match missing or repeated)

What to do on failure

  • 409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
  • 428 A precondition is missing: read the resource and send If-Match (or the required proof).

↑ Back to list