API reference

`/v1/admin/security`

54 operations

← All groups · First call? Read the tutorial: auth, permissions, requests and responses, common failures

Method	Path	Summary	Auth
GET	`/v1/admin/security/autodefense/blocks`	Ban list entries with source autodefense	Session
POST	`/v1/admin/security/autodefense/blocks/{block_id}/release`	Unblock (Lua and kernel), optionally whitelist and report a false positive	Session
GET	`/v1/admin/security/autodefense/events`	Attack event timeline, newest first	Session
GET	`/v1/admin/security/autodefense/false-positives`	False positive reports	Session
POST	`/v1/admin/security/autodefense/false-positives`	Report a verdict or signature as a false positive (the signature is withdrawn at once)	Session
GET	`/v1/admin/security/autodefense/metrics`	Per site report figures of the last 30 days (mitigations, false positive reports, attack events)	Session
GET	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups`	Layer 4 port groups the control plane derives for a node (website TCP ports, one per forward)	Session
GET	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules`	Layer 4 overlay of one node port group (platform only)	Session
GET	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/history`	Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits	Session
PUT	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}`	A person sets an l4 item (manual until resumed)	Session
PUT	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/range`	Narrow the item's automatic range (上下限); state and manual value unchanged	Session
POST	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/resume`	恢复自动 for one l4 item	Session
PUT	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/mode`	manual / auto / suggest of l4; auto needs module.autodefense.auto	Session
POST	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/resume`	全部恢复自动 of l4	Session
GET	`/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/values`	Each node's newest value of every item (in force or suggested) and its reason	Session
GET	`/v1/admin/security/autodefense/platform-settings`	Platform defaults, budgets and breaker thresholds (platform.admin)	Session
PUT	`/v1/admin/security/autodefense/platform-settings`	Replace the platform settings (revision guarded, platform.admin); default_mode protect needs module.autodefense.auto and applies to every following site	Session
GET	`/v1/admin/security/autodefense/signatures`	Automatic rules (signatures)	Session
POST	`/v1/admin/security/autodefense/signatures/{signature_id}/revoke`	禁用此签名	Session
POST	`/v1/admin/security/autodefense/signatures/{signature_id}/solidify`	固化为我的规则 is the tenant's own decision: platform administrators get 403 autodefense_permission_denied	Session
GET	`/v1/admin/security/autodefense/sites`	Sites with mode, baseline maturity, circuit, overlay and the auto-mitigation grant	Session
POST	`/v1/admin/security/autodefense/sites/mode`	Batch 开始学习 / 仅观察 / 开始防护 / 关闭 / 恢复跟随平台 (follow); protect needs module.autodefense.auto; one audit event per site	Session
GET	`/v1/admin/security/autodefense/sites/{site_id}`	One site with its overlay	Session
PATCH	`/v1/admin/security/autodefense/sites/{site_id}`	Sensitivity and cross-site federation (revision guarded)	Session
GET	`/v1/admin/security/autodefense/sites/{site_id}/allows`	白名单: the site's allow list as the nodes get it (ACL allow rules = user, 解除并加白 = release, admin sign-in sources = admin_login); never mitigated	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/allows/remove`	移出白名单: remove one 解除并加白 entry (ACL allows are edited in the ACL policy; admin sign-in sources expire)	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/circuit/resume`	恢复自动防护: close the site circuit the nodes reported open (Q6: a second break within 24 hours needs a person)	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/drifts/confirm`	确认基线漂移: confirm the site's pending baseline drifts (node baselines are not changed)	Session
GET	`/v1/admin/security/autodefense/sites/{site_id}/modules`	Modules site (site.max_level), bot, cc, scan, waf with every item state 自动/人工	Session
GET	`/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/history`	Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits	Session
PUT	`/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}`	A person sets the item: it becomes manual and runs on this value until resumed (Q3)	Session
PUT	`/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/range`	Narrow the item's automatic range (上下限); state and manual value unchanged	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/resume`	恢复自动 for one item	Session
PUT	`/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/mode`	manual / auto / suggest; auto needs module.autodefense.auto	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/resume`	全部恢复自动: every manual item of the module returns to automatic	Session
GET	`/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/values`	Each node's newest value of every item (in force or suggested) and its reason	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/release`	一键解除: undo every automatic mitigation and hold the site in observe only (default 30 minutes)	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/releases/retry`	重试: every serving node applies and answers the release again (retry + 1, at most 100; audited release_retry)	Session
GET	`/v1/admin/security/autodefense/sites/{site_id}/releases/status`	解除状态: per node delivery of the site's single release of one target (已保存 → 待节点 → 全部节点已生效 / 部分失败)	Session
GET	`/v1/admin/security/autodefense/sites/{site_id}/waf-adapt`	Adaptive WAF (智能自动): exclusions by stage with merged evidence, typed parameters, grey zone challenge, rule advice	Session
POST	`/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/exclusions/{exclusion_id}/{action}`	A person's decision: adopt (采纳, a manual exclusion), reject (驳回), revoke (撤销), manual (设为人工), resume (恢复自动); module.autodefense only	Session
PUT	`/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/grey-challenge`	Grey zone challenge inherit / on / off (only 严格 / 极严格 tiers challenge)	Session
PUT	`/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/grey-repeat`	Repeated grey zone source threshold / window of the site (null = node defaults 20 / 60 s)	Session
GET	`/v1/admin/security/autodefense/verdicts`	Recent individual verdicts	Session
POST	`/v1/admin/security/autodefense/verdicts/{verdict_id}/release`	解除 / 解除并加白 / 标记误判	Session
GET	`/v1/admin/security/cc-stats`	Read the CC rule statistics of a site of any tenant scope	Session
GET	`/v1/admin/security/coordination/metrics`	Read bounded cross-node CC and global firewall coordination counters	Session
GET	`/v1/admin/security/escalate/sites/{site_id}`	Read a site of any tenant scope	Session
GET	`/v1/admin/security/escalate/sites/{site_id}/events`	List the level history of a site of any tenant scope	Session
POST	`/v1/admin/security/escalate/sites/{site_id}/lock`	Hold a site at a level (管理员锁定) until unlocked	Session
POST	`/v1/admin/security/escalate/sites/{site_id}/reset`	Send a site back to level A now (一键回切), unlocking it	Session
POST	`/v1/admin/security/escalate/sites/{site_id}/unlock`	Release a site's lock (automatic levels resume)	Session
POST	`/v1/admin/security/ja4-blocks`	Create a tenant/site-scoped JA4 block as a platform administrator	Session
GET	`/v1/admin/security/ja4-blocks/{workflow_id}`	Get one exact tenant JA4 block workflow without raw access events	Session

Contract file：api/control-autodefense.openapi.yaml api/control-cc-stats.openapi.yaml api/control-security-coordination-metrics.openapi.yaml api/control-escalate.openapi.yaml api/control-ja4-block.openapi.yaml

Operation details

GET `/v1/admin/security/autodefense/blocks`

Ban list entries with source autodefense

operationId

adminListAutoDefenseBlocks

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseBlocks Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	No	Admin list routes only; filters the list to one tenant scope. Without it the platform administrator reads every tenant of this control plane (each row carries tenant_scope_id); the limit caps still apply.
`site_id`	query	`string(uuid)`	No	—
`ip`	query	`any \| any`	No	—
`limit`	query	`integer`	No	—

Responses

adminListAutoDefenseBlocks Responses
Status	Description
`200`	Ban list entries with source autodefense. Fields：`items: array<BlockEntry>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/blocks/{block_id}/release`

Unblock (Lua and kernel), optionally whitelist and report a false positive

operationId

adminReleaseAutoDefenseBlock

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminReleaseAutoDefenseBlock Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`block_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminReleaseAutoDefenseBlock Request body
Name	Type	Required	Description
`whitelist`	`boolean`	No	解除并加白 (IP
`allow_until`	`object`	No	When the 解除并加白 entry expires (absent = permanent; only with whitelist; after now and within 365 days). An entry already listed keeps the longer expiry.
`false_positive`	`boolean`	No	标记误判; reason is then required and a false_positive_report is audited.
`reason`	`string`	No	—

Responses

adminReleaseAutoDefenseBlock Responses
Status	Description
`200`	What the release undid. Fields：`site_id: string(uuid)` `released_targets: array<string>` `shadowed_signatures: array<string>` `whitelisted: array<string>` `allows: array<SiteAllow>` `observe_until?: string(date-time)` `false_positive_id?: string(uuid)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/events`

Attack event timeline, newest first

operationId

adminListAutoDefenseEvents

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseEvents Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.
`site_id`	query	`string(uuid)`	No	—
`limit`	query	`integer`	No	—

Responses

adminListAutoDefenseEvents Responses
Status	Description
`200`	Attack events. Fields：`items: array<Event>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/false-positives`

False positive reports

operationId

adminListAutoDefenseFalsePositives

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseFalsePositives Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	No	Admin list routes only; filters the list to one tenant scope. Without it the platform administrator reads every tenant of this control plane (each row carries tenant_scope_id); the limit caps still apply.
`site_id`	query	`string(uuid)`	No	—
`limit`	query	`integer`	No	—

Responses

adminListAutoDefenseFalsePositives Responses
Status	Description
`200`	False positive reports. Fields：`items: array<FalsePositive>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/false-positives`

Report a verdict or signature as a false positive (the signature is withdrawn at once)

operationId

adminReportAutoDefenseFalsePositive

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminReportAutoDefenseFalsePositive Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminReportAutoDefenseFalsePositive Request body
Name	Type	Required	Description
`site_id`	`string(uuid)`	Yes	—
`verdict_id`	`string(uuid)`	No	—
`signature_id`	`string`	No	—
`reason`	`object`	Yes	—

Responses

adminReportAutoDefenseFalsePositive Responses
Status	Description
`201`	The recorded report. Fields：`id: string(uuid)` `site_id: string(uuid)` `tenant_scope_id: string(uuid)` `verdict_id?: string(uuid)` `block_id?: string(uuid)` `signature_id?: string` `target?: string` `reason: string` `reported_by: string` `created_at: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/metrics`

Per site report figures of the last 30 days (mitigations, false positive reports, attack events)

operationId

adminListAutoDefenseSiteMetrics

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseSiteMetrics Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	No	Admin list routes only; filters the list to one tenant scope. Without it the platform administrator reads every tenant of this control plane (each row carries tenant_scope_id); the limit caps still apply.

Responses

adminListAutoDefenseSiteMetrics Responses
Status	Description
`200`	Report figures per live site of the tenant (at most 500). Fields：`items: array<SiteMetrics>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups`

Layer 4 port groups the control plane derives for a node (website TCP ports, one per forward)

operationId

listAutoDefensePortGroups

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

listAutoDefensePortGroups Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—

Responses

listAutoDefensePortGroups Responses
Status	Description
`200`	The node's derived port groups in ID order. Fields：`items: array<PortGroup>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules`

Layer 4 overlay of one node port group (platform only)

operationId

listAutoDefensePortGroupModules

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

listAutoDefensePortGroupModules Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—

Responses

listAutoDefensePortGroupModules Responses
Status	Description
`200`	Modules with their items. Fields：`items: array<Module>` `auto_mitigation_granted: boolean` `overlay: string: active / frozen / inactive`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/history`

Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits

operationId

listAutoDefensePortGroupModuleHistory

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

listAutoDefensePortGroupModuleHistory Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—
`module`	path	`string: l4`	Yes	—
`limit`	query	`integer`	No	—

Responses

listAutoDefensePortGroupModuleHistory Responses
Status	Description
`200`	Item changes, newest first. Fields：`items: array<HistoryEntry>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}`

A person sets an l4 item (manual until resumed)

operationId

lockAutoDefensePortGroupItem

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

lockAutoDefensePortGroupItem Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—
`module`	path	`string: l4`	Yes	—
`field`	path	`string`	Yes	A field of the frozen registry of the module; waf.group:<slug> per rule group.

Request body

application/json · Required：Yes

lockAutoDefensePortGroupItem Request body
Name	Type	Required	Description
`value`	`integer`	Yes	Within the field platform range; enum fields take the ordinal, bool 0 or 1.

Responses

lockAutoDefensePortGroupItem Responses
Status	Description
`200`	The locked item. Fields：`field: string` `kind: string: int / enum / bool` `unit?: string` `enum?: array<string>` `state: string: auto / manual` `manual: integer` `auto?: integer` `min: integer` `max: integer` `platform_min: integer` `platform_max: integer` `effective: integer` `suggestion?: integer` `locked_by?: string` `locked_at?: string(date-time)` `resumed_by?: string` `resumed_at?: string(date-time)` `frozen_until?: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/range`

Narrow the item's automatic range (上下限); state and manual value unchanged

operationId

setAutoDefensePortGroupItemRange

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

setAutoDefensePortGroupItemRange Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—
`module`	path	`string: l4`	Yes	—
`field`	path	`string`	Yes	A field of the frozen registry of the module; waf.group:<slug> per rule group.

Request body

application/json · Required：Yes

setAutoDefensePortGroupItemRange Request body
Name	Type	Required	Description
`min`	`integer`	Yes	Within the field platform range, min <= max; bound to the manual value as the field requires.
`max`	`integer`	Yes	—

Responses

setAutoDefensePortGroupItemRange Responses
Status	Description
`200`	The locked item. Fields：`field: string` `kind: string: int / enum / bool` `unit?: string` `enum?: array<string>` `state: string: auto / manual` `manual: integer` `auto?: integer` `min: integer` `max: integer` `platform_min: integer` `platform_max: integer` `effective: integer` `suggestion?: integer` `locked_by?: string` `locked_at?: string(date-time)` `resumed_by?: string` `resumed_at?: string(date-time)` `frozen_until?: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/resume`

恢复自动 for one l4 item

operationId

resumeAutoDefensePortGroupItem

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

resumeAutoDefensePortGroupItem Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—
`module`	path	`string: l4`	Yes	—
`field`	path	`string`	Yes	A field of the frozen registry of the module; waf.group:<slug> per rule group.

Request body

application/json · Required：No

Responses

resumeAutoDefensePortGroupItem Responses
Status	Description
`200`	Items that changed (empty when nothing was manual). Fields：`items: array<Item>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/mode`

manual / auto / suggest of l4; auto needs module.autodefense.auto

operationId

setAutoDefensePortGroupModuleMode

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

setAutoDefensePortGroupModuleMode Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—
`module`	path	`string: l4`	Yes	—

Request body

application/json · Required：Yes

setAutoDefensePortGroupModuleMode Request body
Name	Type	Required	Description
`mode`	`string: manual / auto / suggest`	Yes	—

Responses

setAutoDefensePortGroupModuleMode Responses
Status	Description
`200`	The module mode now in force. Fields：`module: string` `mode: string: manual / auto / suggest`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/resume`

全部恢复自动 of l4

operationId

resumeAutoDefensePortGroupModule

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

resumeAutoDefensePortGroupModule Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—
`module`	path	`string: l4`	Yes	—

Request body

application/json · Required：No

Responses

resumeAutoDefensePortGroupModule Responses
Status	Description
`200`	Items that changed (empty when nothing was manual). Fields：`items: array<Item>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/values`

Each node's newest value of every item (in force or suggested) and its reason

operationId

listAutoDefensePortGroupModuleValues

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

listAutoDefensePortGroupModuleValues Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`node_id`	path	`string(uuid)`	Yes	—
`port_group_id`	path	`string`	Yes	—
`module`	path	`string: l4`	Yes	—

Responses

listAutoDefensePortGroupModuleValues Responses
Status	Description
`200`	Each node's newest value per item. Fields：`items: array<NodeValue>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/platform-settings`

Platform defaults, budgets and breaker thresholds (platform.admin)

operationId

getAutoDefensePlatformSettings

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin

Required features：module.autodefense

Parameters

getAutoDefensePlatformSettings Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.

Responses

getAutoDefensePlatformSettings Responses
Status	Description
`200`	Platform settings. Fields：`default_mode: string: off / learning / observe / protect` `default_sensitivity: string: low / medium / high` `following_sites: integer` `admin_login_whitelist_days: integer` `max_sites_per_node: integer` `ban_l3_per_site_minute: integer` `ban_l4_per_site_minute: integer` `circuit_resume_minutes: integer` `circuit_manual_after_breaks: integer` `waf_adapt_shadow_hours: integer` `waf_adapt_active_days: integer` `waf_grey_challenge: boolean` `waf_exclusion_latency_us: integer` `waf_exclusion_memory_percent: integer` `revision: integer` `updated_at: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/platform-settings`

Replace the platform settings (revision guarded, platform.admin); default_mode protect needs module.autodefense.auto and applies to every following site

operationId

putAutoDefensePlatformSettings

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin

Required features：module.autodefense module.autodefense.auto

Parameters

putAutoDefensePlatformSettings Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.

Request body

application/json · Required：Yes

putAutoDefensePlatformSettings Request body
Name	Type	Required	Description
`default_mode`	`string: off / learning / observe / protect`	Yes	Mode of every site that follows the platform. protect needs module.autodefense.auto; sites still on the prior or short of samples mitigate within their maturity cap (prior <= L1, immature <= L2).
`default_sensitivity`	`string: low / medium / high`	Yes	—
`following_sites`	`integer`	No	Live sites following the platform default_mode (ignored on PUT).
`admin_login_whitelist_days`	`integer`	Yes	—
`max_sites_per_node`	`integer`	Yes	—
`ban_l3_per_site_minute`	`integer`	Yes	—
`ban_l4_per_site_minute`	`integer`	Yes	—
`circuit_resume_minutes`	`integer`	Yes	—
`circuit_manual_after_breaks`	`integer`	Yes	—
`waf_adapt_shadow_hours`	`integer`	Yes	—
`waf_adapt_active_days`	`integer`	Yes	—
`waf_grey_challenge`	`boolean`	Yes	Grey zone challenge of sites that inherit it (default true).
`waf_exclusion_latency_us`	`integer`	Yes	waf-exclcap2: extra time one request may pay for its site's automatic exclusions on a node (default 500 us); each node applies floor(95% of the budget / its measured per exclusion cost) of a site's ranked exclusions (5% headroom).
`waf_exclusion_memory_percent`	`integer`	Yes	waf-exclcap2: share of node memory all automatic exclusions of a node may take (default 5); beyond it the lowest traffic sites lose their lowest ranked exclusions first.
`revision`	`integer`	Yes	—
`updated_at`	`string(date-time)`	No	—

Responses

putAutoDefensePlatformSettings Responses
Status	Description
`200`	Platform settings. Fields：`default_mode: string: off / learning / observe / protect` `default_sensitivity: string: low / medium / high` `following_sites: integer` `admin_login_whitelist_days: integer` `max_sites_per_node: integer` `ban_l3_per_site_minute: integer` `ban_l4_per_site_minute: integer` `circuit_resume_minutes: integer` `circuit_manual_after_breaks: integer` `waf_adapt_shadow_hours: integer` `waf_adapt_active_days: integer` `waf_grey_challenge: boolean` `waf_exclusion_latency_us: integer` `waf_exclusion_memory_percent: integer` `revision: integer` `updated_at: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/signatures`

Automatic rules (signatures)

operationId

adminListAutoDefenseSignatures

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseSignatures Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	No	Admin list routes only; filters the list to one tenant scope. Without it the platform administrator reads every tenant of this control plane (each row carries tenant_scope_id); the limit caps still apply.
`site_id`	query	`string(uuid)`	No	—
`limit`	query	`integer`	No	—

Responses

adminListAutoDefenseSignatures Responses
Status	Description
`200`	Automatic rules. Fields：`items: array<Signature>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/signatures/{signature_id}/revoke`

禁用此签名

operationId

adminRevokeAutoDefenseSignature

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminRevokeAutoDefenseSignature Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`signature_id`	path	`string`	Yes	SHA-256 of the canonical conditions, first 16 hex digits (contract 3.4).
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：No

Responses

adminRevokeAutoDefenseSignature Responses
Status	Description
`200`	One automatic rule. Fields：`id: string` `site_id: string(uuid)` `tenant_scope_id: string(uuid)` `conditions: array<object>` `stage: string: shadow / challenge / block / standby` `cover_permille: integer` `fpr_ppm: integer` `hits: integer` `reason: string` `managed: boolean` `solidified_kind?: string: waf / cc` `solidified_rule_id?: string(uuid)` `solidified_pack_id?: string` `solidified_version?: string` `revoked: boolean` `origin: string: node / control` `origin_node_id?: string(uuid)` `evaluation: object` `scope: string: site / tenant / none` `created_at: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/signatures/{signature_id}/solidify`

固化为我的规则 is the tenant's own decision: platform administrators get 403 autodefense_permission_denied

operationId

adminSolidifyAutoDefenseSignature

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminSolidifyAutoDefenseSignature Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`signature_id`	path	`string`	Yes	SHA-256 of the canonical conditions, first 16 hex digits (contract 3.4).
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminSolidifyAutoDefenseSignature Request body
Name	Type	Required	Description
`kind`	`string: waf / cc`	Yes	—

Responses

adminSolidifyAutoDefenseSignature Responses
Status	Description
`200`	One automatic rule. Fields：`id: string` `site_id: string(uuid)` `tenant_scope_id: string(uuid)` `conditions: array<object>` `stage: string: shadow / challenge / block / standby` `cover_permille: integer` `fpr_ppm: integer` `hits: integer` `reason: string` `managed: boolean` `solidified_kind?: string: waf / cc` `solidified_rule_id?: string(uuid)` `solidified_pack_id?: string` `solidified_version?: string` `revoked: boolean` `origin: string: node / control` `origin_node_id?: string(uuid)` `evaluation: object` `scope: string: site / tenant / none` `created_at: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites`

Sites with mode, baseline maturity, circuit, overlay and the auto-mitigation grant

operationId

adminListAutoDefenseSites

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseSites Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	No	Admin list routes only; filters the list to one tenant scope. Without it the platform administrator reads every tenant of this control plane (each row carries tenant_scope_id); the limit caps still apply.
`limit`	query	`integer`	No	—

Responses

adminListAutoDefenseSites Responses
Status	Description
`200`	Sites of the tenant. Fields：`items: array<Site>` `auto_mitigation_granted: boolean`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/mode`

Batch 开始学习 / 仅观察 / 开始防护 / 关闭 / 恢复跟随平台 (follow); protect needs module.autodefense.auto; one audit event per site

operationId

adminSetAutoDefenseSiteModes

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

adminSetAutoDefenseSiteModes Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminSetAutoDefenseSiteModes Request body
Name	Type	Required	Description
`site_ids`	`array<string(uuid)>`	Yes	—
`mode`	`string: off / learning / observe / protect / follow`	Yes	The site's own mode; follow = 跟随平台 (the site takes the platform default_mode and changes with it).
`confirm`	`boolean`	Yes	Batch operations need an explicit confirmation.

Responses

adminSetAutoDefenseSiteModes Responses
Status	Description
`200`	The sites and their mode before and after. Fields：`items: array<object>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites/{site_id}`

One site with its overlay

operationId

adminGetAutoDefenseSite

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminGetAutoDefenseSite Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Responses

adminGetAutoDefenseSite Responses
Status	Description
`200`	One site with the snapshot delivery state of every node serving it. Fields：`site_id: string(uuid)` `tenant_scope_id: string(uuid)` `domain: string` `tenant_name: string` `state: string: normal / surge / protect_origin / attack / cooldown / circuit_open / baseline_stale` `current_level: integer` `last_event_reason?: string` `mode: string: off / learning / observe / protect` `follow_platform: boolean` `sensitivity: string: low / medium / high` `maturity: string: prior / hour / day / week` `cross_site: boolean` `circuit: Circuit` `observe_until?: string(date-time)` `last_event_at?: string(date-time)` `revision: integer` `updated_at: string(date-time)` `auto_mitigation_granted: boolean` `overlay: string: active / frozen / inactive` `max_level: Item` `modules: array<Module>` `drifts?: array<Drift>` `nodes: array<SiteNode>` `unsupported_nodes: array<string>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PATCH `/v1/admin/security/autodefense/sites/{site_id}`

Sensitivity and cross-site federation (revision guarded)

operationId

adminUpdateAutoDefenseSite

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminUpdateAutoDefenseSite Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminUpdateAutoDefenseSite Request body
Name	Type	Required	Description
`sensitivity`	`string: low / medium / high`	No	—
`cross_site`	`boolean`	No	—
`revision`	`integer`	Yes	—

Responses

adminUpdateAutoDefenseSite Responses
Status	Description
`200`	One site. Fields：`site_id: string(uuid)` `tenant_scope_id: string(uuid)` `domain: string` `tenant_name: string` `state: string: normal / surge / protect_origin / attack / cooldown / circuit_open / baseline_stale` `current_level: integer` `last_event_reason?: string` `mode: string: off / learning / observe / protect` `follow_platform: boolean` `sensitivity: string: low / medium / high` `maturity: string: prior / hour / day / week` `cross_site: boolean` `circuit: Circuit` `observe_until?: string(date-time)` `last_event_at?: string(date-time)` `revision: integer` `updated_at: string(date-time)` `auto_mitigation_granted: boolean` `overlay: string: active / frozen / inactive` `max_level: Item` `modules: array<Module>` `drifts?: array<Drift>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites/{site_id}/allows`

白名单: the site's allow list as the nodes get it (ACL allow rules = user, 解除并加白 = release, admin sign-in sources = admin_login); never mitigated

operationId

adminListAutoDefenseSiteAllows

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseSiteAllows Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Responses

adminListAutoDefenseSiteAllows Responses
Status	Description
`200`	The site's allow list in CIDR order. Fields：`items: array<SiteAllow>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/allows/remove`

移出白名单: remove one 解除并加白 entry (ACL allows are edited in the ACL policy; admin sign-in sources expire)

operationId

adminRemoveAutoDefenseSiteAllow

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminRemoveAutoDefenseSiteAllow Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminRemoveAutoDefenseSiteAllow Request body
Name	Type	Required	Description
`cidr`	`string`	No	The 解除并加白 entry (IP address or network).
`ja4`	`string`	No	The 解除并加白 entry (JA4 fingerprint).

Responses

adminRemoveAutoDefenseSiteAllow Responses
Status	Description
`200`	The removed allow list entry. Fields：`cidr?: string` `ja4?: string` `source: string: user / release / admin_login` `until?: string(date-time)` `created_by?: string` `created_at?: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/circuit/resume`

恢复自动防护: close the site circuit the nodes reported open (Q6: a second break within 24 hours needs a person)

operationId

adminResumeAutoDefenseSiteCircuit

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

adminResumeAutoDefenseSiteCircuit Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：No

Responses

adminResumeAutoDefenseSiteCircuit Responses
Status	Description
`200`	One site. Fields：`site_id: string(uuid)` `tenant_scope_id: string(uuid)` `domain: string` `tenant_name: string` `state: string: normal / surge / protect_origin / attack / cooldown / circuit_open / baseline_stale` `current_level: integer` `last_event_reason?: string` `mode: string: off / learning / observe / protect` `follow_platform: boolean` `sensitivity: string: low / medium / high` `maturity: string: prior / hour / day / week` `cross_site: boolean` `circuit: Circuit` `observe_until?: string(date-time)` `last_event_at?: string(date-time)` `revision: integer` `updated_at: string(date-time)` `auto_mitigation_granted: boolean` `overlay: string: active / frozen / inactive` `max_level: Item` `modules: array<Module>` `drifts?: array<Drift>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/drifts/confirm`

确认基线漂移: confirm the site's pending baseline drifts (node baselines are not changed)

operationId

adminConfirmAutoDefenseSiteDrifts

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminConfirmAutoDefenseSiteDrifts Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：No

Responses

adminConfirmAutoDefenseSiteDrifts Responses
Status	Description
`200`	The drifts the confirmation changed (empty when none was pending). Fields：`items: array<Drift>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites/{site_id}/modules`

Modules site (site.max_level), bot, cc, scan, waf with every item state 自动/人工

operationId

adminListAutoDefenseSiteModules

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseSiteModules Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Responses

adminListAutoDefenseSiteModules Responses
Status	Description
`200`	Modules with their items. Fields：`items: array<Module>` `auto_mitigation_granted: boolean` `overlay: string: active / frozen / inactive`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/history`

Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits

operationId

adminListAutoDefenseSiteModuleHistory

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseSiteModuleHistory Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`module`	path	`string: site / bot / cc / scan / waf`	Yes	site holds the single item site.max_level (no module mode).
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.
`limit`	query	`integer`	No	—

Responses

adminListAutoDefenseSiteModuleHistory Responses
Status	Description
`200`	Item changes, newest first. Fields：`items: array<HistoryEntry>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}`

A person sets the item: it becomes manual and runs on this value until resumed (Q3)

operationId

adminLockAutoDefenseSiteItem

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminLockAutoDefenseSiteItem Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`module`	path	`string: site / bot / cc / scan / waf`	Yes	site holds the single item site.max_level (no module mode).
`field`	path	`string`	Yes	A field of the frozen registry of the module; waf.group:<slug> per rule group.
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminLockAutoDefenseSiteItem Request body
Name	Type	Required	Description
`value`	`integer`	Yes	Within the field platform range; enum fields take the ordinal, bool 0 or 1.

Responses

adminLockAutoDefenseSiteItem Responses
Status	Description
`200`	The locked item. Fields：`field: string` `kind: string: int / enum / bool` `unit?: string` `enum?: array<string>` `state: string: auto / manual` `manual: integer` `auto?: integer` `min: integer` `max: integer` `platform_min: integer` `platform_max: integer` `effective: integer` `suggestion?: integer` `locked_by?: string` `locked_at?: string(date-time)` `resumed_by?: string` `resumed_at?: string(date-time)` `frozen_until?: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/range`

Narrow the item's automatic range (上下限); state and manual value unchanged

operationId

adminSetAutoDefenseSiteItemRange

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminSetAutoDefenseSiteItemRange Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`module`	path	`string: site / bot / cc / scan / waf`	Yes	site holds the single item site.max_level (no module mode).
`field`	path	`string`	Yes	A field of the frozen registry of the module; waf.group:<slug> per rule group.
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminSetAutoDefenseSiteItemRange Request body
Name	Type	Required	Description
`min`	`integer`	Yes	Within the field platform range, min <= max; bound to the manual value as the field requires.
`max`	`integer`	Yes	—

Responses

adminSetAutoDefenseSiteItemRange Responses
Status	Description
`200`	The locked item. Fields：`field: string` `kind: string: int / enum / bool` `unit?: string` `enum?: array<string>` `state: string: auto / manual` `manual: integer` `auto?: integer` `min: integer` `max: integer` `platform_min: integer` `platform_max: integer` `effective: integer` `suggestion?: integer` `locked_by?: string` `locked_at?: string(date-time)` `resumed_by?: string` `resumed_at?: string(date-time)` `frozen_until?: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/resume`

恢复自动 for one item

operationId

adminResumeAutoDefenseSiteItem

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

adminResumeAutoDefenseSiteItem Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`module`	path	`string: site / bot / cc / scan / waf`	Yes	site holds the single item site.max_level (no module mode).
`field`	path	`string`	Yes	A field of the frozen registry of the module; waf.group:<slug> per rule group.
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：No

Responses

adminResumeAutoDefenseSiteItem Responses
Status	Description
`200`	Items that changed (empty when nothing was manual). Fields：`items: array<Item>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/mode`

manual / auto / suggest; auto needs module.autodefense.auto

operationId

adminSetAutoDefenseSiteModuleMode

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

adminSetAutoDefenseSiteModuleMode Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`module`	path	`string: site / bot / cc / scan / waf`	Yes	site holds the single item site.max_level (no module mode).
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminSetAutoDefenseSiteModuleMode Request body
Name	Type	Required	Description
`mode`	`string: manual / auto / suggest`	Yes	—

Responses

adminSetAutoDefenseSiteModuleMode Responses
Status	Description
`200`	The module mode now in force. Fields：`module: string` `mode: string: manual / auto / suggest`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/resume`

全部恢复自动: every manual item of the module returns to automatic

operationId

adminResumeAutoDefenseSiteModule

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense module.autodefense.auto

Parameters

adminResumeAutoDefenseSiteModule Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`module`	path	`string: site / bot / cc / scan / waf`	Yes	site holds the single item site.max_level (no module mode).
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：No

Responses

adminResumeAutoDefenseSiteModule Responses
Status	Description
`200`	Items that changed (empty when nothing was manual). Fields：`items: array<Item>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/values`

Each node's newest value of every item (in force or suggested) and its reason

operationId

adminListAutoDefenseSiteModuleValues

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseSiteModuleValues Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`module`	path	`string: site / bot / cc / scan / waf`	Yes	site holds the single item site.max_level (no module mode).
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Responses

adminListAutoDefenseSiteModuleValues Responses
Status	Description
`200`	Each node's newest value per item. Fields：`items: array<NodeValue>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/release`

一键解除: undo every automatic mitigation and hold the site in observe only (default 30 minutes)

operationId

adminReleaseAutoDefenseSite

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminReleaseAutoDefenseSite Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminReleaseAutoDefenseSite Request body
Name	Type	Required	Description
`observe_minutes`	`integer`	No	0 = no observe-only hold.
`reason`	`string`	No	—

Responses

adminReleaseAutoDefenseSite Responses
Status	Description
`200`	What the release undid. Fields：`site_id: string(uuid)` `released_targets: array<string>` `shadowed_signatures: array<string>` `whitelisted: array<string>` `allows: array<SiteAllow>` `observe_until?: string(date-time)` `false_positive_id?: string(uuid)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/releases/retry`

重试: every serving node applies and answers the release again (retry + 1, at most 100; audited release_retry)

operationId

adminRetryAutoDefenseRelease

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminRetryAutoDefenseRelease Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminRetryAutoDefenseRelease Request body
Name	Type	Required	Description
`kind`	`string: ip / cidr / ja4`	Yes	—
`target`	`string`	Yes	—

Responses

adminRetryAutoDefenseRelease Responses
Status	Description
`200`	The per node delivery of a single release. Fields：`site_id: string(uuid)` `kind: string: ip / cidr / ja4` `target: string` `released_at: string(date-time)` `retry: integer` `state: string: pending / applied / partial_failed / no_nodes` `nodes: array<object>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites/{site_id}/releases/status`

解除状态: per node delivery of the site's single release of one target (已保存 → 待节点 → 全部节点已生效 / 部分失败)

operationId

adminGetAutoDefenseReleaseStatus

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminGetAutoDefenseReleaseStatus Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.
`kind`	query	`string: ip / cidr / ja4`	Yes	—
`target`	query	`string`	Yes	—

Responses

adminGetAutoDefenseReleaseStatus Responses
Status	Description
`200`	The per node delivery of a single release. Fields：`site_id: string(uuid)` `kind: string: ip / cidr / ja4` `target: string` `released_at: string(date-time)` `retry: integer` `state: string: pending / applied / partial_failed / no_nodes` `nodes: array<object>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/sites/{site_id}/waf-adapt`

Adaptive WAF (智能自动): exclusions by stage with merged evidence, typed parameters, grey zone challenge, rule advice

operationId

adminGetAutoDefenseSiteWAFAdapt

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin waf_adapt.read

Required features：module.autodefense

Parameters

adminGetAutoDefenseSiteWAFAdapt Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Responses

adminGetAutoDefenseSiteWAFAdapt Responses
Status	Description
`200`	The site's adaptive WAF state. Fields：`site_id: string(uuid)` `runtime: object` `automatic: boolean` `auto_granted: boolean` `waf_mode: string: manual / auto / suggest` `frozen: boolean` `grey_challenge: object` `grey_repeat: object` `revision: integer` `evaluated_at: string(date-time) \| null` `settings: object` `exclusions: array<WAFExclusion>` `typed_params: array<object>` `rule_advice: array<object>` `limits: object` `node_limits: array<object>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/exclusions/{exclusion_id}/{action}`

A person's decision: adopt (采纳, a manual exclusion), reject (驳回), revoke (撤销), manual (设为人工), resume (恢复自动); module.autodefense only

operationId

adminDecideAutoDefenseSiteWAFExclusion

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin waf_adapt.manage

Required features：module.autodefense

Parameters

adminDecideAutoDefenseSiteWAFExclusion Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`exclusion_id`	path	`string`	Yes	WAFExclusionID (SHA-256 of "<rule>:<loc>:<name>", first 16 hex digits).
`action`	path	`string: adopt / reject / revoke / manual / resume`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：No

Responses

adminDecideAutoDefenseSiteWAFExclusion Responses
Status	Description
`200`	The exclusion after the decision. Fields：`id: string` `rule: integer` `rule_set: string` `rule_set_name: string` `param: object` `stage: string: candidate / shadow / suggested / active / rejected` `stage_since: string(date-time)` `until: string(date-time) \| null` `manual: string: none / exclude / keep` `manual_by: string \| null` `manual_at: string(date-time) \| null` `rejections: integer` `reject_reason: string: false_positive / attack / unneeded \| null` `permanent: boolean` `cooldown_until: string(date-time) \| null` `value_type: string: number / ident / text / json / binary / url` `len_bucket: integer` `evidence: object` `flipped: integer` `flipped_attack: integer` `first_seen: string(date-time)` `last_seen: string(date-time)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/grey-challenge`

Grey zone challenge inherit / on / off (only 严格 / 极严格 tiers challenge)

operationId

adminSetAutoDefenseSiteGreyChallenge

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin waf_adapt.manage

Required features：module.autodefense

Parameters

adminSetAutoDefenseSiteGreyChallenge Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminSetAutoDefenseSiteGreyChallenge Request body
Name	Type	Required	Description
`value`	`string: inherit / on / off`	Yes	—

Responses

adminSetAutoDefenseSiteGreyChallenge Responses
Status	Description
`200`	The grey zone challenge before and after. Fields：`before: string: inherit / on / off` `value: string: inherit / on / off`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

PUT `/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/grey-repeat`

Repeated grey zone source threshold / window of the site (null = node defaults 20 / 60 s)

operationId

adminSetAutoDefenseSiteGreyRepeat

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin waf_adapt.manage

Required features：module.autodefense

Description (from the contract)

Only nodes declaring CAPABILITY_NAME_WAF_REPEAT_SITE use the site value; other nodes keep the defaults.

Parameters

adminSetAutoDefenseSiteGreyRepeat Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminSetAutoDefenseSiteGreyRepeat Request body
Name	Type	Required	Description
`value`	`GreyRepeat \| null`	Yes	—

Responses

adminSetAutoDefenseSiteGreyRepeat Responses
Status	Description
`200`	The repeat setting before and after (null = node defaults). Fields：`before: GreyRepeat \| null` `value: GreyRepeat \| null`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/autodefense/verdicts`

Recent individual verdicts

operationId

adminListAutoDefenseVerdicts

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Required features：module.autodefense

Parameters

adminListAutoDefenseVerdicts Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`tenant_scope_id`	query	`string(uuid)`	No	Admin list routes only; filters the list to one tenant scope. Without it the platform administrator reads every tenant of this control plane (each row carries tenant_scope_id); the limit caps still apply.
`site_id`	query	`string(uuid)`	No	—
`ip`	query	`any \| any`	No	—
`limit`	query	`integer`	No	—

Responses

adminListAutoDefenseVerdicts Responses
Status	Description
`200`	Verdicts. Fields：`items: array<Verdict>`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

POST `/v1/admin/security/autodefense/verdicts/{verdict_id}/release`

解除 / 解除并加白 / 标记误判

operationId

adminReleaseAutoDefenseVerdict

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Required features：module.autodefense

Parameters

adminReleaseAutoDefenseVerdict Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	Echoed in X-Request-ID and error.request_id; generated when absent.
`verdict_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	Admin routes only; the tenant scope the platform administrator acts on.

Request body

application/json · Required：Yes

adminReleaseAutoDefenseVerdict Request body
Name	Type	Required	Description
`whitelist`	`boolean`	No	解除并加白 (IP
`allow_until`	`object`	No	When the 解除并加白 entry expires (absent = permanent; only with whitelist; after now and within 365 days). An entry already listed keeps the longer expiry.
`false_positive`	`boolean`	No	标记误判; reason is then required and a false_positive_report is audited.
`reason`	`string`	No	—

Responses

adminReleaseAutoDefenseVerdict Responses
Status	Description
`200`	What the release undid. Fields：`site_id: string(uuid)` `released_targets: array<string>` `shadowed_signatures: array<string>` `whitelisted: array<string>` `allows: array<SiteAllow>` `observe_until?: string(date-time)` `false_positive_id?: string(uuid)`
`default`	ErrorEnvelope; entitlement_feature_denied carries error.capability.feature.

↑ Back to list

GET `/v1/admin/security/cc-stats`

Read the CC rule statistics of a site of any tenant scope

operationId

getAdminSiteCCStats

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Parameters

getAdminSiteCCStats Parameters
Name	In	Type	Required	Description
`tenant_scope_id`	query	`string(uuid)`	Yes	—
`site_id`	query	`string(uuid)`	Yes	—
`range`	query	`string: 1h / 6h / 24h`	No	1h (1 minute steps, default), 6h (5 minutes) or 24h (15 minutes).

Responses

getAdminSiteCCStats Responses
Status	Description
`200`	The site's CC rule statistics. Fields：`tenant_scope_id: string(uuid)` `range: string: 1h / 6h / 24h` `site_id: string(uuid)` `from: string(date-time)` `to: string(date-time)` `step_seconds: integer: 60 / 300 / 900` `series: array<object>` `rules: array<object>` `top_clients: array<Top>` `top_paths: array<Top>`
`400`	Error.
`401`	Error.
`403`	Error.
`404`	Error.
`405`	Error.
`503`	Error.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
404 The resource does not exist or belongs to another tenant.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

GET `/v1/admin/security/coordination/metrics`

Read bounded cross-node CC and global firewall coordination counters

operationId

getSecurityCoordinationMetrics

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Description (from the contract)

Returns fixed-cardinality process counters. Node, tenant, policy, subject, address, and message labels are never exposed.

Responses

getSecurityCoordinationMetrics Responses
Status	Description
`200`	Fixed-cardinality in-process security coordination counters. Fields：`schema: string` `cc: CCMetrics` `firewall: FirewallMetrics`
`400`	Stable error code without identity or dependency detail.
`401`	Stable error code without identity or dependency detail.
`403`	Stable error code without identity or dependency detail.
`405`	Stable error code without identity or dependency detail.
`503`	Stable error code without identity or dependency detail.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

GET `/v1/admin/security/escalate/sites/{site_id}`

Read a site of any tenant scope

operationId

getAdminEscalateSite

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin

Parameters

getAdminEscalateSite Parameters
Name	In	Type	Required	Description
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	—

Responses

getAdminEscalateSite Responses
Status	Description
`200`	The site's settings, its package's ranges, the thresholds in force and its state. Fields：`settings: object` `policy: Policy` `effective: object` `state: State`
`400`	Error.
`401`	Error.
`403`	Error.
`404`	Error.
`409`	Error.
`503`	Error.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
404 The resource does not exist or belongs to another tenant.
409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

GET `/v1/admin/security/escalate/sites/{site_id}/events`

List the level history of a site of any tenant scope

operationId

listAdminEscalateSiteEvents

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin

Parameters

listAdminEscalateSiteEvents Parameters
Name	In	Type	Required	Description
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	—

Responses

listAdminEscalateSiteEvents Responses
Status	Description
`200`	Level history, newest first. Fields：`items: array<Event>`
`400`	Error.
`401`	Error.
`403`	Error.
`404`	Error.
`503`	Error.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
404 The resource does not exist or belongs to another tenant.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

POST `/v1/admin/security/escalate/sites/{site_id}/lock`

Hold a site at a level (管理员锁定) until unlocked

operationId

lockEscalateSite

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin

Required features：module.escalate

Description (from the contract)

422 escalate_level_unavailable when the site's package cannot put the level in force (B/C without a line group, C via Cloudflare not bound and synced, D with the blackhole off, or no policy).

Parameters

lockEscalateSite Parameters
Name	In	Type	Required	Description
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	—

Request body

application/json · Required：Yes

lockEscalateSite Request body
Name	Type	Required	Description
`level`	`string: A / B / C / D`	Yes	—
`revision`	`integer(int64)`	Yes	The state revision read (0 when the site was never stepped).

Responses

lockEscalateSite Responses
Status	Description
`200`	The site's state after the write. Fields：`level: string: A / B / C / D` `applied_level: string: A / B / C / D` `c_via: string: / line_group / cloudflare / unlimited` `pending_reason: string` `entered_at?: string(date-time)` `last_qps: integer(int64)` `last_bps: integer(int64)` `attacked: boolean` `locked_level?: string: A / B / C / D` `revision: integer(int64)` `updated_at?: string(date-time)` `dns_ttl?: integer(int32)` `ttl_clamped?: boolean` `dropped_packets_5m?: integer(int64)` `drop_shared?: boolean` `platform_dns_hosted?: boolean` `split_cname?: string` `cname_auto?: object`
`400`	Error.
`401`	Error.
`403`	Error.
`404`	Error.
`409`	Error.
`422`	Error.
`503`	Error.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
404 The resource does not exist or belongs to another tenant.
409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

POST `/v1/admin/security/escalate/sites/{site_id}/reset`

Send a site back to level A now (一键回切), unlocking it

operationId

resetEscalateSite

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin

Required features：module.escalate

Parameters

resetEscalateSite Parameters
Name	In	Type	Required	Description
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	—

Request body

application/json · Required：Yes

resetEscalateSite Request body
Name	Type	Required	Description
`revision`	`integer(int64)`	Yes	The state revision read (0 when the site was never stepped).

Responses

resetEscalateSite Responses
Status	Description
`200`	The site's state after the write. Fields：`level: string: A / B / C / D` `applied_level: string: A / B / C / D` `c_via: string: / line_group / cloudflare / unlimited` `pending_reason: string` `entered_at?: string(date-time)` `last_qps: integer(int64)` `last_bps: integer(int64)` `attacked: boolean` `locked_level?: string: A / B / C / D` `revision: integer(int64)` `updated_at?: string(date-time)` `dns_ttl?: integer(int32)` `ttl_clamped?: boolean` `dropped_packets_5m?: integer(int64)` `drop_shared?: boolean` `platform_dns_hosted?: boolean` `split_cname?: string` `cname_auto?: object`
`400`	Error.
`401`	Error.
`403`	Error.
`404`	Error.
`409`	Error.
`503`	Error.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
404 The resource does not exist or belongs to another tenant.
409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

POST `/v1/admin/security/escalate/sites/{site_id}/unlock`

Release a site's lock (automatic levels resume)

operationId

unlockEscalateSite

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin

Required features：module.escalate

Parameters

unlockEscalateSite Parameters
Name	In	Type	Required	Description
`site_id`	path	`string(uuid)`	Yes	—
`tenant_scope_id`	query	`string(uuid)`	Yes	—

Request body

application/json · Required：Yes

unlockEscalateSite Request body
Name	Type	Required	Description
`revision`	`integer(int64)`	Yes	The state revision read (0 when the site was never stepped).

Responses

unlockEscalateSite Responses
Status	Description
`200`	The site's state after the write. Fields：`level: string: A / B / C / D` `applied_level: string: A / B / C / D` `c_via: string: / line_group / cloudflare / unlimited` `pending_reason: string` `entered_at?: string(date-time)` `last_qps: integer(int64)` `last_bps: integer(int64)` `attacked: boolean` `locked_level?: string: A / B / C / D` `revision: integer(int64)` `updated_at?: string(date-time)` `dns_ttl?: integer(int32)` `ttl_clamped?: boolean` `dropped_packets_5m?: integer(int64)` `drop_shared?: boolean` `platform_dns_hosted?: boolean` `split_cname?: string` `cname_auto?: object`
`400`	Error.
`401`	Error.
`403`	Error.
`404`	Error.
`409`	Error.
`503`	Error.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
404 The resource does not exist or belongs to another tenant.
409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

POST `/v1/admin/security/ja4-blocks`

Create a tenant/site-scoped JA4 block as a platform administrator

operationId

createAdminJA4BlockWorkflow

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.manage

Parameters

createAdminJA4BlockWorkflow Parameters
Name	In	Type	Required	Description
`X-Request-ID`	header	`string`	No	—
`Idempotency-Key`	header	`string`	Yes	—
`If-Match`	header	`string`	Yes	—
`X-Step-Up-Token`	header	`string`	Yes	Single-use proof consumed by the configured step-up verifier; never persisted.

Request body

application/json · Required：Yes

createAdminJA4BlockWorkflow Request body
Name	Type	Required	Description
`site_id`	`string(uuid)`	Yes	—
`ja4`	`string`	Yes	—
`snapshot_at`	`string(date-time)`	Yes	—
`duration_seconds`	`integer`	Yes	—
`reason`	`string`	Yes	—
`tenant_scope_id`	`string(uuid)`	Yes	—

Responses

createAdminJA4BlockWorkflow Responses
Status	Description
`202`	Durable workflow created or exact idempotent replay returned. Fields：`id: string(uuid)` `tenant_scope_id: string(uuid)` `site_id: string(uuid)` `ja4_sha256: string` `snapshot_at: string(date-time)` `duration_seconds: integer` `reason: string` `phase: string: queued / policy_ready / edge_pending / active / failed / expired` `revision: integer` `policy_id?: string(uuid)` `policy_revision?: integer` `binding_id?: string(uuid)` `binding_revision?: integer` `edge_publication_id?: string(uuid)` `rollout_id: string(uuid)` `edge_state: string: / pending / active / failed / rolled_back` `attempt_count: integer` `last_error_code?: string` `replayed?: boolean`
`400`	Stable error response.
`401`	Stable error response.
`403`	Stable error response.
`409`	Stable error response.
`412`	Stable error response.
`428`	Stable error response.
`503`	Stable error response.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
412 The revision changed: read the latest ETag, decide again, then send the new If-Match.
428 A precondition is missing: read the resource and send If-Match (or the required proof).
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

GET `/v1/admin/security/ja4-blocks/{workflow_id}`

Get one exact tenant JA4 block workflow without raw access events

operationId

getAdminJA4BlockWorkflow

Auth

Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.

Required permissions

All of：platform.admin security_policies.read

Parameters

getAdminJA4BlockWorkflow Parameters
Name	In	Type	Required	Description
`workflow_id`	path	`string(uuid)`	Yes	—
`X-Request-ID`	header	`string`	No	—
`tenant_scope_id`	query	`string(uuid)`	Yes	—

Responses

getAdminJA4BlockWorkflow Responses
Status	Description
`200`	Fixed workflow state; raw access events are never returned. Fields：`id: string(uuid)` `tenant_scope_id: string(uuid)` `site_id: string(uuid)` `ja4_sha256: string` `snapshot_at: string(date-time)` `duration_seconds: integer` `reason: string` `phase: string: queued / policy_ready / edge_pending / active / failed / expired` `revision: integer` `policy_id?: string(uuid)` `policy_revision?: integer` `binding_id?: string(uuid)` `binding_revision?: integer` `edge_publication_id?: string(uuid)` `rollout_id: string(uuid)` `edge_state: string: / pending / active / failed / rolled_back` `attempt_count: integer` `last_error_code?: string` `replayed?: boolean`
`400`	Stable error response.
`401`	Stable error response.
`403`	Stable error response.
`404`	Stable error response.
`503`	Stable error response.

What to do on failure

400 Fix the parameters or body per the field list; do not retry unchanged.
401 Check the credential format and whether it expired or was rotated.
403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
404 The resource does not exist or belongs to another tenant.
503 A dependency is unavailable: retry later with the original Idempotency-Key.

↑ Back to list

/v1/admin/security

Operation details

GET /v1/admin/security/autodefense/blocks

Parameters

Responses

POST /v1/admin/security/autodefense/blocks/{block_id}/release

Parameters

Request body

Responses

GET /v1/admin/security/autodefense/events

Parameters

Responses

GET /v1/admin/security/autodefense/false-positives

Parameters

Responses

POST /v1/admin/security/autodefense/false-positives

Parameters

Request body

Responses

GET /v1/admin/security/autodefense/metrics

Parameters

Responses

GET /v1/admin/security/autodefense/nodes/{node_id}/port-groups

Parameters

Responses

GET /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules

Parameters

Responses

GET /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/history

Parameters

Responses

PUT /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}

Parameters

Request body

Responses

PUT /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/range

Parameters

Request body

Responses

POST /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/resume

Parameters

Request body

Responses

PUT /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/mode

Parameters

Request body

Responses

POST /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/resume

Parameters

Request body

Responses

GET /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/values

Parameters

Responses

GET /v1/admin/security/autodefense/platform-settings

Parameters

Responses

PUT /v1/admin/security/autodefense/platform-settings

Parameters

Request body

Responses

GET /v1/admin/security/autodefense/signatures

Parameters

Responses

POST /v1/admin/security/autodefense/signatures/{signature_id}/revoke

Parameters

Request body

Responses

POST /v1/admin/security/autodefense/signatures/{signature_id}/solidify

Parameters

Request body

Responses

GET /v1/admin/security/autodefense/sites

Parameters

Responses

POST /v1/admin/security/autodefense/sites/mode

Parameters

Request body

Responses

GET /v1/admin/security/autodefense/sites/{site_id}

`/v1/admin/security`

GET `/v1/admin/security/autodefense/blocks`

POST `/v1/admin/security/autodefense/blocks/{block_id}/release`

GET `/v1/admin/security/autodefense/events`

GET `/v1/admin/security/autodefense/false-positives`

POST `/v1/admin/security/autodefense/false-positives`

GET `/v1/admin/security/autodefense/metrics`

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups`

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules`

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/history`

PUT `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}`

PUT `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/range`

POST `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/resume`

PUT `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/mode`

POST `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/resume`

GET `/v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/values`

GET `/v1/admin/security/autodefense/platform-settings`

PUT `/v1/admin/security/autodefense/platform-settings`

GET `/v1/admin/security/autodefense/signatures`

POST `/v1/admin/security/autodefense/signatures/{signature_id}/revoke`

POST `/v1/admin/security/autodefense/signatures/{signature_id}/solidify`

GET `/v1/admin/security/autodefense/sites`

POST `/v1/admin/security/autodefense/sites/mode`

GET `/v1/admin/security/autodefense/sites/{site_id}`

PATCH `/v1/admin/security/autodefense/sites/{site_id}`

GET `/v1/admin/security/autodefense/sites/{site_id}/allows`

POST `/v1/admin/security/autodefense/sites/{site_id}/allows/remove`

POST `/v1/admin/security/autodefense/sites/{site_id}/circuit/resume`

POST `/v1/admin/security/autodefense/sites/{site_id}/drifts/confirm`

GET `/v1/admin/security/autodefense/sites/{site_id}/modules`

GET `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/history`

PUT `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}`

PUT `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/range`

POST `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/resume`

PUT `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/mode`

POST `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/resume`

GET `/v1/admin/security/autodefense/sites/{site_id}/modules/{module}/values`

POST `/v1/admin/security/autodefense/sites/{site_id}/release`

POST `/v1/admin/security/autodefense/sites/{site_id}/releases/retry`

GET `/v1/admin/security/autodefense/sites/{site_id}/releases/status`

GET `/v1/admin/security/autodefense/sites/{site_id}/waf-adapt`

POST `/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/exclusions/{exclusion_id}/{action}`

PUT `/v1/admin/security/autodefense/sites/{site_id}/waf-adapt/grey-challenge`