| Method | Path | Summary | Auth |
|---|---|---|---|
| GET | /v1/security/autodefense/blocks | Ban list entries with source autodefense | Session |
| POST | /v1/security/autodefense/blocks/{block_id}/release | Unblock (Lua and kernel), optionally whitelist and report a false positive | Session |
| GET | /v1/security/autodefense/events | Attack event timeline, newest first | Session |
| GET | /v1/security/autodefense/false-positives | False positive reports | Session |
| POST | /v1/security/autodefense/false-positives | Report a verdict or signature as a false positive (the signature is withdrawn at once) | Session |
| GET | /v1/security/autodefense/metrics | Per site report figures of the last 30 days (mitigations, false positive reports, attack events) | Session |
| GET | /v1/security/autodefense/signatures | Automatic rules (signatures) | Session |
| POST | /v1/security/autodefense/signatures/{signature_id}/revoke | 禁用此签名 | Session |
| POST | /v1/security/autodefense/signatures/{signature_id}/solidify | 固化为我的规则: becomes a user WAF/CC rule and leaves automatic management | Session |
| GET | /v1/security/autodefense/sites | Sites with mode, baseline maturity, circuit, overlay and the auto-mitigation grant | Session |
| POST | /v1/security/autodefense/sites/mode | Batch 开始学习 / 仅观察 / 开始防护 / 关闭; protect needs module.autodefense.auto; one audit event per site | Session |
| GET | /v1/security/autodefense/sites/{site_id} | One site with its overlay | Session |
| PATCH | /v1/security/autodefense/sites/{site_id} | Sensitivity and cross-site federation (revision guarded) | Session |
| POST | /v1/security/autodefense/sites/{site_id}/circuit/resume | 恢复自动防护: close the site circuit the nodes reported open (Q6: a second break within 24 hours needs a person) | Session |
| POST | /v1/security/autodefense/sites/{site_id}/drifts/confirm | 确认基线漂移: confirm the site's pending baseline drifts (node baselines are not changed) | Session |
| GET | /v1/security/autodefense/sites/{site_id}/modules | Modules site (site.max_level), bot, cc, scan, waf with every item state 自动/人工 | Session |
| GET | /v1/security/autodefense/sites/{site_id}/modules/{module}/history | Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits | Session |
| PUT | /v1/security/autodefense/sites/{site_id}/modules/{module}/items/{field} | A person sets the item: it becomes manual and runs on this value until resumed (Q3) | Session |
| PUT | /v1/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/range | Narrow the item's automatic range (上下限); state and manual value unchanged | Session |
| POST | /v1/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/resume | 恢复自动 for one item | Session |
| PUT | /v1/security/autodefense/sites/{site_id}/modules/{module}/mode | manual / auto / suggest; auto needs module.autodefense.auto | Session |
| POST | /v1/security/autodefense/sites/{site_id}/modules/{module}/resume | 全部恢复自动: every manual item of the module returns to automatic | Session |
| GET | /v1/security/autodefense/sites/{site_id}/modules/{module}/values | Each node's newest value of every item (in force or suggested) and its reason | Session |
| POST | /v1/security/autodefense/sites/{site_id}/release | 一键解除: undo every automatic mitigation and hold the site in observe only (default 30 minutes) | Session |
| GET | /v1/security/autodefense/sites/{site_id}/waf-adapt | Adaptive WAF (智能自动): exclusions by stage with merged evidence, typed parameters, grey zone challenge, rule advice | Session |
| POST | /v1/security/autodefense/sites/{site_id}/waf-adapt/exclusions/{exclusion_id}/{action} | A person's decision: adopt (采纳, a manual exclusion), reject (驳回), revoke (撤销), manual (设为人工), resume (恢复自动); module.autodefense only | Session |
| PUT | /v1/security/autodefense/sites/{site_id}/waf-adapt/grey-challenge | Grey zone challenge inherit / on / off (only 严格 / 极严格 tiers challenge) | Session |
| GET | /v1/security/autodefense/verdicts | Recent individual verdicts | Session |
| POST | /v1/security/autodefense/verdicts/{verdict_id}/release | 解除 / 解除并加白 / 标记误判 | Session |
| GET | /v1/security/cc-stats | Read the CC rule statistics of a site of the session tenant | Session |
| GET | /v1/security/escalate/sites/{site_id} | Read a site's attack escalation settings, thresholds in force and state | Session |
| PUT | /v1/security/escalate/sites/{site_id} | Switch attack escalation on or off for a site and set its thresholds inside the package ranges | Session |
| POST | /v1/security/escalate/sites/{site_id}/cname-changed | Confirm the site's domain now points at the CNAME split off for escalation | Session |
| GET | /v1/security/escalate/sites/{site_id}/events | List a site's level history, newest first (100 rows) | Session |
| POST | /v1/security/ja4-blocks | Create a tenant-scoped JA4 block from one authoritative ranking snapshot | Session |
| GET | /v1/security/ja4-blocks/{workflow_id} | Get fixed JA4 block policy, binding, publication, and rollout state | Session |
Contract file：api/control-autodefense.openapi.yaml api/control-cc-stats.openapi.yaml api/control-escalate.openapi.yaml api/control-ja4-block.openapi.yaml