| 方法 | 路径 | 摘要 | 认证 |
|---|---|---|---|
| GET | /v1/admin/gateways | List standalone Agent Gateways (platform session, system.gateway.manage) | 登录会话 |
| POST | /v1/admin/gateways | Add a Gateway and issue its one-time binding token (1 hour, single use, only the SHA-256 is stored) | 登录会话 |
| DELETE | /v1/admin/gateways/{id} | Delete a Gateway; every certificate it was issued is revoked | 登录会话 |
| PUT | /v1/admin/gateways/{id}/allowed-ips | Replace the addresses a bound Gateway may connect from (IPv4/IPv6, 1–16, audited) | 登录会话 |
| POST | /v1/admin/gateways/{id}/binding-token | Replace the binding token of a pending Gateway (the previous token stops working) | 登录会话 |
| POST | /v1/admin/gateways/{id}/disable | Disable a bound Gateway; its ControlInternal calls are refused | 登录会话 |
| POST | /v1/admin/gateways/{id}/enable | Re-enable a disabled Gateway | 登录会话 |
契约文件：api/openapi/v1/control.yaml