| 方法 | 路径 | 摘要 | 认证 |
|---|---|---|---|
| GET | /v1/admin/security/autodefense/blocks | Ban list entries with source autodefense | 登录会话 |
| POST | /v1/admin/security/autodefense/blocks/{block_id}/release | Unblock (Lua and kernel), optionally whitelist and report a false positive | 登录会话 |
| GET | /v1/admin/security/autodefense/events | Attack event timeline, newest first | 登录会话 |
| GET | /v1/admin/security/autodefense/false-positives | False positive reports | 登录会话 |
| POST | /v1/admin/security/autodefense/false-positives | Report a verdict or signature as a false positive (the signature is withdrawn at once) | 登录会话 |
| GET | /v1/admin/security/autodefense/metrics | Per site report figures of the last 30 days (mitigations, false positive reports, attack events) | 登录会话 |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups | Layer 4 port groups the control plane derives for a node (website TCP ports, one per forward) | 登录会话 |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules | Layer 4 overlay of one node port group (platform only) | 登录会话 |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/history | Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits | 登录会话 |
| PUT | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field} | A person sets an l4 item (manual until resumed) | 登录会话 |
| PUT | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/range | Narrow the item's automatic range (上下限); state and manual value unchanged | 登录会话 |
| POST | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/resume | 恢复自动 for one l4 item | 登录会话 |
| PUT | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/mode | manual / auto / suggest of l4; auto needs module.autodefense.auto | 登录会话 |
| POST | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/resume | 全部恢复自动 of l4 | 登录会话 |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/values | Each node's newest value of every item (in force or suggested) and its reason | 登录会话 |
| GET | /v1/admin/security/autodefense/platform-settings | Platform defaults, budgets and breaker thresholds (platform.admin) | 登录会话 |
| PUT | /v1/admin/security/autodefense/platform-settings | Replace the platform settings (revision guarded, platform.admin) | 登录会话 |
| GET | /v1/admin/security/autodefense/signatures | Automatic rules (signatures) | 登录会话 |
| POST | /v1/admin/security/autodefense/signatures/{signature_id}/revoke | 禁用此签名 | 登录会话 |
| POST | /v1/admin/security/autodefense/signatures/{signature_id}/solidify | 固化为我的规则 is the tenant's own decision: platform administrators get 403 autodefense_permission_denied | 登录会话 |
| GET | /v1/admin/security/autodefense/sites | Sites with mode, baseline maturity, circuit, overlay and the auto-mitigation grant | 登录会话 |
| POST | /v1/admin/security/autodefense/sites/mode | Batch 开始学习 / 仅观察 / 开始防护 / 关闭; protect needs module.autodefense.auto; one audit event per site | 登录会话 |
| GET | /v1/admin/security/autodefense/sites/{site_id} | One site with its overlay | 登录会话 |
| PATCH | /v1/admin/security/autodefense/sites/{site_id} | Sensitivity and cross-site federation (revision guarded) | 登录会话 |
| POST | /v1/admin/security/autodefense/sites/{site_id}/circuit/resume | 恢复自动防护: close the site circuit the nodes reported open (Q6: a second break within 24 hours needs a person) | 登录会话 |
| POST | /v1/admin/security/autodefense/sites/{site_id}/drifts/confirm | 确认基线漂移: confirm the site's pending baseline drifts (node baselines are not changed) | 登录会话 |
| GET | /v1/admin/security/autodefense/sites/{site_id}/modules | Modules site (site.max_level), bot, cc, scan, waf with every item state 自动/人工 | 登录会话 |
| GET | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/history | Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits | 登录会话 |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field} | A person sets the item: it becomes manual and runs on this value until resumed (Q3) | 登录会话 |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/range | Narrow the item's automatic range (上下限); state and manual value unchanged | 登录会话 |
| POST | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/resume | 恢复自动 for one item | 登录会话 |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/mode | manual / auto / suggest; auto needs module.autodefense.auto | 登录会话 |
| POST | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/resume | 全部恢复自动: every manual item of the module returns to automatic | 登录会话 |
| GET | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/values | Each node's newest value of every item (in force or suggested) and its reason | 登录会话 |
| POST | /v1/admin/security/autodefense/sites/{site_id}/release | 一键解除: undo every automatic mitigation and hold the site in observe only (default 30 minutes) | 登录会话 |
| GET | /v1/admin/security/autodefense/sites/{site_id}/waf-adapt | Adaptive WAF (智能自动): exclusions by stage with merged evidence, typed parameters, grey zone challenge, rule advice | 登录会话 |
| POST | /v1/admin/security/autodefense/sites/{site_id}/waf-adapt/exclusions/{exclusion_id}/{action} | A person's decision: adopt (采纳, a manual exclusion), reject (驳回), revoke (撤销), manual (设为人工), resume (恢复自动); module.autodefense only | 登录会话 |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/waf-adapt/grey-challenge | Grey zone challenge inherit / on / off (only 严格 / 极严格 tiers challenge) | 登录会话 |
| GET | /v1/admin/security/autodefense/verdicts | Recent individual verdicts | 登录会话 |
| POST | /v1/admin/security/autodefense/verdicts/{verdict_id}/release | 解除 / 解除并加白 / 标记误判 | 登录会话 |
| GET | /v1/admin/security/cc-stats | Read the CC rule statistics of a site of any tenant scope | 登录会话 |
| GET | /v1/admin/security/coordination/metrics | Read bounded cross-node CC and global firewall coordination counters | 登录会话 |
| GET | /v1/admin/security/escalate/sites/{site_id} | Read a site of any tenant scope | 登录会话 |
| GET | /v1/admin/security/escalate/sites/{site_id}/events | List the level history of a site of any tenant scope | 登录会话 |
| POST | /v1/admin/security/escalate/sites/{site_id}/lock | Hold a site at a level (管理员锁定) until unlocked | 登录会话 |
| POST | /v1/admin/security/escalate/sites/{site_id}/reset | Send a site back to level A now (一键回切), unlocking it | 登录会话 |
| POST | /v1/admin/security/escalate/sites/{site_id}/unlock | Release a site's lock (automatic levels resume) | 登录会话 |
| POST | /v1/admin/security/ja4-blocks | Create a tenant/site-scoped JA4 block as a platform administrator | 登录会话 |
| GET | /v1/admin/security/ja4-blocks/{workflow_id} | Get one exact tenant JA4 block workflow without raw access events | 登录会话 |
契约文件：api/control-autodefense.openapi.yaml api/control-cc-stats.openapi.yaml api/control-security-coordination-metrics.openapi.yaml api/control-escalate.openapi.yaml api/control-ja4-block.openapi.yaml