| Method | Path | Summary | Auth |
|---|---|---|---|
| GET | /v1/admin/security/autodefense/blocks | Ban list entries with source autodefense | Session |
| POST | /v1/admin/security/autodefense/blocks/{block_id}/release | Unblock (Lua and kernel), optionally whitelist and report a false positive | Session |
| GET | /v1/admin/security/autodefense/events | Attack event timeline, newest first | Session |
| GET | /v1/admin/security/autodefense/false-positives | False positive reports | Session |
| POST | /v1/admin/security/autodefense/false-positives | Report a verdict or signature as a false positive (the signature is withdrawn at once) | Session |
| GET | /v1/admin/security/autodefense/metrics | Per site report figures of the last 30 days (mitigations, false positive reports, attack events) | Session |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups | Layer 4 port groups the control plane derives for a node (website TCP ports, one per forward) | Session |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules | Layer 4 overlay of one node port group (platform only) | Session |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/history | Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits | Session |
| PUT | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field} | A person sets an l4 item (manual until resumed) | Session |
| PUT | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/range | Narrow the item's automatic range (上下限); state and manual value unchanged | Session |
| POST | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/items/{field}/resume | 恢复自动 for one l4 item | Session |
| PUT | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/mode | manual / auto / suggest of l4; auto needs module.autodefense.auto | Session |
| POST | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/resume | 全部恢复自动 of l4 | Session |
| GET | /v1/admin/security/autodefense/nodes/{node_id}/port-groups/{port_group_id}/modules/{module}/values | Each node's newest value of every item (in force or suggested) and its reason | Session |
| GET | /v1/admin/security/autodefense/platform-settings | Platform defaults, budgets and breaker thresholds (platform.admin) | Session |
| PUT | /v1/admin/security/autodefense/platform-settings | Replace the platform settings (revision guarded, platform.admin) | Session |
| GET | /v1/admin/security/autodefense/signatures | Automatic rules (signatures) | Session |
| POST | /v1/admin/security/autodefense/signatures/{signature_id}/revoke | 禁用此签名 | Session |
| POST | /v1/admin/security/autodefense/signatures/{signature_id}/solidify | 固化为我的规则 is the tenant's own decision: platform administrators get 403 autodefense_permission_denied | Session |
| GET | /v1/admin/security/autodefense/sites | Sites with mode, baseline maturity, circuit, overlay and the auto-mitigation grant | Session |
| POST | /v1/admin/security/autodefense/sites/mode | Batch 开始学习 / 仅观察 / 开始防护 / 关闭; protect needs module.autodefense.auto; one audit event per site | Session |
| GET | /v1/admin/security/autodefense/sites/{site_id} | One site with its overlay | Session |
| PATCH | /v1/admin/security/autodefense/sites/{site_id} | Sensitivity and cross-site federation (revision guarded) | Session |
| POST | /v1/admin/security/autodefense/sites/{site_id}/circuit/resume | 恢复自动防护: close the site circuit the nodes reported open (Q6: a second break within 24 hours needs a person) | Session |
| POST | /v1/admin/security/autodefense/sites/{site_id}/drifts/confirm | 确认基线漂移: confirm the site's pending baseline drifts (node baselines are not changed) | Session |
| GET | /v1/admin/security/autodefense/sites/{site_id}/modules | Modules site (site.max_level), bot, cc, scan, waf with every item state 自动/人工 | Session |
| GET | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/history | Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits | Session |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field} | A person sets the item: it becomes manual and runs on this value until resumed (Q3) | Session |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/range | Narrow the item's automatic range (上下限); state and manual value unchanged | Session |
| POST | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/resume | 恢复自动 for one item | Session |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/mode | manual / auto / suggest; auto needs module.autodefense.auto | Session |
| POST | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/resume | 全部恢复自动: every manual item of the module returns to automatic | Session |
| GET | /v1/admin/security/autodefense/sites/{site_id}/modules/{module}/values | Each node's newest value of every item (in force or suggested) and its reason | Session |
| POST | /v1/admin/security/autodefense/sites/{site_id}/release | 一键解除: undo every automatic mitigation and hold the site in observe only (default 30 minutes) | Session |
| GET | /v1/admin/security/autodefense/sites/{site_id}/waf-adapt | Adaptive WAF (智能自动): exclusions by stage with merged evidence, typed parameters, grey zone challenge, rule advice | Session |
| POST | /v1/admin/security/autodefense/sites/{site_id}/waf-adapt/exclusions/{exclusion_id}/{action} | A person's decision: adopt (采纳, a manual exclusion), reject (驳回), revoke (撤销), manual (设为人工), resume (恢复自动); module.autodefense only | Session |
| PUT | /v1/admin/security/autodefense/sites/{site_id}/waf-adapt/grey-challenge | Grey zone challenge inherit / on / off (only 严格 / 极严格 tiers challenge) | Session |
| GET | /v1/admin/security/autodefense/verdicts | Recent individual verdicts | Session |
| POST | /v1/admin/security/autodefense/verdicts/{verdict_id}/release | 解除 / 解除并加白 / 标记误判 | Session |
| GET | /v1/admin/security/cc-stats | Read the CC rule statistics of a site of any tenant scope | Session |
| GET | /v1/admin/security/coordination/metrics | Read bounded cross-node CC and global firewall coordination counters | Session |
| GET | /v1/admin/security/escalate/sites/{site_id} | Read a site of any tenant scope | Session |
| GET | /v1/admin/security/escalate/sites/{site_id}/events | List the level history of a site of any tenant scope | Session |
| POST | /v1/admin/security/escalate/sites/{site_id}/lock | Hold a site at a level (管理员锁定) until unlocked | Session |
| POST | /v1/admin/security/escalate/sites/{site_id}/reset | Send a site back to level A now (一键回切), unlocking it | Session |
| POST | /v1/admin/security/escalate/sites/{site_id}/unlock | Release a site's lock (automatic levels resume) | Session |
| POST | /v1/admin/security/ja4-blocks | Create a tenant/site-scoped JA4 block as a platform administrator | Session |
| GET | /v1/admin/security/ja4-blocks/{workflow_id} | Get one exact tenant JA4 block workflow without raw access events | Session |
Contract file：api/control-autodefense.openapi.yaml api/control-cc-stats.openapi.yaml api/control-security-coordination-metrics.openapi.yaml api/control-escalate.openapi.yaml api/control-ja4-block.openapi.yaml