| Method | Path | Summary | Auth |
|---|---|---|---|
| GET | /v1/admin/gateways | List standalone Agent Gateways (platform session, system.gateway.manage) | Session |
| POST | /v1/admin/gateways | Add a Gateway and issue its one-time binding token (1 hour, single use, only the SHA-256 is stored) | Session |
| DELETE | /v1/admin/gateways/{id} | Delete a Gateway; every certificate it was issued is revoked | Session |
| PUT | /v1/admin/gateways/{id}/allowed-ips | Replace the addresses a bound Gateway may connect from (IPv4/IPv6, 1–16, audited) | Session |
| POST | /v1/admin/gateways/{id}/binding-token | Replace the binding token of a pending Gateway (the previous token stops working) | Session |
| POST | /v1/admin/gateways/{id}/disable | Disable a bound Gateway; its ControlInternal calls are refused | Session |
| POST | /v1/admin/gateways/{id}/enable | Re-enable a disabled Gateway | Session |
Contract file：api/openapi/v1/control.yaml