Operation details
POST /v1/openresty-security/actions/download-cc-image
- operationId
queueCCImageDownload- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.manage
Parameters
queueCCImageDownload Parameters| Name | In | Type | Required | Description |
|---|
Idempotency-Key | header | string | Yes | — |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Responses
queueCCImageDownload Responses| Status | Description |
|---|
202 | Durable download_cc_img task queued |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
409 | Duplicate target or idempotency conflict |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
↑ Back to list
GET /v1/openresty-security/configs/global
- operationId
getGlobalOpenRestySecurityConfig- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.read
Responses
getGlobalOpenRestySecurityConfig Responses| Status | Description |
|---|
200 | Current redacted configuration document Fields：id: string(uuid) scope_type: string: global / region / node scope_id: string scope_label?: string revision: integer config: Config key_configured: boolean updated_at: string(date-time) sources?: object |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
↑ Back to list
PATCH /v1/openresty-security/configs/global
- operationId
patchGlobalOpenRestySecurityConfig- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.manage
Description (from the contract)
Applies the smallest auto-save patch. A logical retry must reuse the same Idempotency-Key.
Parameters
patchGlobalOpenRestySecurityConfig Parameters| Name | In | Type | Required | Description |
|---|
If-Match | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | — |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Request body
application/json · Required：Yes
patchGlobalOpenRestySecurityConfig Request body| Name | Type | Required | Description |
|---|
patch | Config | Yes | — |
|---|
Responses
patchGlobalOpenRestySecurityConfig Responses| Status | Description |
|---|
200 | Current redacted configuration document Fields：id: string(uuid) scope_type: string: global / region / node scope_id: string scope_label?: string revision: integer config: Config key_configured: boolean updated_at: string(date-time) sources?: object |
|---|
400 | Invalid field, conditional value, range, or relationship |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
409 | Duplicate target or idempotency conflict |
|---|
412 | If-Match revision conflict |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.412 The revision changed: read the latest ETag, decide again, then send the new If-Match.
↑ Back to list
GET /v1/openresty-security/effective
- operationId
getEffectiveOpenRestySecurityConfig- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.read
Description (from the contract)
Resolves the deterministic node-over-region-over-global configuration.
Parameters
getEffectiveOpenRestySecurityConfig Parameters| Name | In | Type | Required | Description |
|---|
node_id | query | string(uuid) | Yes | — |
|---|
Responses
getEffectiveOpenRestySecurityConfig Responses| Status | Description |
|---|
200 | Current redacted configuration document Fields：id: string(uuid) scope_type: string: global / region / node scope_id: string scope_label?: string revision: integer config: Config key_configured: boolean updated_at: string(date-time) sources?: object |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
404 | Target absent or hidden across tenant boundary |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.
↑ Back to list
GET /v1/openresty-security/overrides
- operationId
listOpenRestySecurityOverrides- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.read
Parameters
listOpenRestySecurityOverrides Parameters| Name | In | Type | Required | Description |
|---|
scope_type | query | string: region / node | No | — |
|---|
query | query | string | No | — |
|---|
page | query | integer | No | — |
|---|
page_size | query | integer | No | — |
|---|
Responses
listOpenRestySecurityOverrides Responses| Status | Description |
|---|
200 | Stable page ordered by update time Fields：items: array<Document> page: integer page_size: integer total: integer |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
↑ Back to list
POST /v1/openresty-security/overrides
- operationId
createOpenRestySecurityOverride- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.manage
Parameters
createOpenRestySecurityOverride Parameters| Name | In | Type | Required | Description |
|---|
If-Match | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | — |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Request body
application/json · Required：Yes
createOpenRestySecurityOverride Request body| Name | Type | Required | Description |
|---|
scope_type | string: region / node | Yes | — |
|---|
scope_id | string | Yes | — |
|---|
config | OverrideConfig | Yes | Sparse override allowlist of exactly the 24 observed selectable configuration groups. |
|---|
Responses
createOpenRestySecurityOverride Responses| Status | Description |
|---|
201 | Current redacted configuration document Fields：id: string(uuid) scope_type: string: global / region / node scope_id: string scope_label?: string revision: integer config: Config key_configured: boolean updated_at: string(date-time) sources?: object |
|---|
400 | Invalid field, conditional value, range, or relationship |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
409 | Duplicate target or idempotency conflict |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.
↑ Back to list
PATCH /v1/openresty-security/overrides/{id}
- operationId
patchOpenRestySecurityOverride- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.manage
Parameters
patchOpenRestySecurityOverride Parameters| Name | In | Type | Required | Description |
|---|
id | path | string(uuid) | Yes | — |
|---|
If-Match | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | — |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Request body
application/json · Required：Yes
patchOpenRestySecurityOverride Request body| Name | Type | Required | Description |
|---|
patch | OverrideConfig | Yes | Sparse override allowlist of exactly the 24 observed selectable configuration groups. |
|---|
removed_fields | array<string> | No | — |
|---|
Responses
patchOpenRestySecurityOverride Responses| Status | Description |
|---|
200 | Current redacted configuration document Fields：id: string(uuid) scope_type: string: global / region / node scope_id: string scope_label?: string revision: integer config: Config key_configured: boolean updated_at: string(date-time) sources?: object |
|---|
400 | Invalid field, conditional value, range, or relationship |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
404 | Target absent or hidden across tenant boundary |
|---|
409 | Duplicate target or idempotency conflict |
|---|
412 | If-Match revision conflict |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.412 The revision changed: read the latest ETag, decide again, then send the new If-Match.
↑ Back to list
DELETE /v1/openresty-security/overrides/{id}
- operationId
deleteOpenRestySecurityOverride- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.manage
Parameters
deleteOpenRestySecurityOverride Parameters| Name | In | Type | Required | Description |
|---|
id | path | string(uuid) | Yes | — |
|---|
If-Match | header | string | Yes | — |
|---|
Idempotency-Key | header | string | Yes | — |
|---|
X-Request-ID | header | string | Yes | — |
|---|
Responses
deleteOpenRestySecurityOverride Responses| Status | Description |
|---|
204 | Deleted; a replay returns the same result |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
404 | Target absent or hidden across tenant boundary |
|---|
412 | If-Match revision conflict |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.412 The revision changed: read the latest ETag, decide again, then send the new If-Match.
↑ Back to list
GET /v1/openresty-security/targets
- operationId
searchOpenRestySecurityTargets- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：openresty_security.read
Parameters
searchOpenRestySecurityTargets Parameters| Name | In | Type | Required | Description |
|---|
scope_type | query | string: region / node | Yes | — |
|---|
query | query | string | No | — |
|---|
page | query | integer | No | — |
|---|
page_size | query | integer | No | — |
|---|
Responses
searchOpenRestySecurityTargets Responses| Status | Description |
|---|
200 | Remote node or distinct-region search results Fields：items: array<Target> page: integer page_size: integer total: integer |
|---|
401 | Authentication required |
|---|
403 | Permission denied |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.
↑ Back to list