| Method | Path | Summary | Auth |
|---|---|---|---|
| GET | /v1/site-publications | List publications in the authenticated tenant scope | API keySession |
| POST | /v1/site-publications | Publish the authenticated tenant scope | Session |
| GET | /v1/site-publications/security-activations | Get the authoritative security binding and latest activation candidate | API keySession |
| POST | /v1/site-publications/security-activations | Stage a security policy candidate and start its canary rollout | API keySession |
| GET | /v1/site-publications/security-activations/{candidate_id} | Get a security policy activation candidate | API keySession |
| POST | /v1/site-publications/security-activations/{candidate_id}/reconcile | Reconcile canary, expansion, recovery, and promotion | API keySession |
| POST | /v1/site-publications/security-activations/{candidate_id}/rollback | Clone an old policy into a new monotonic version and stage it | API keySession |
| GET | /v1/site-publications/{publication_id} | Get one publication in the authenticated tenant scope | API keySession |
Contract file：api/control-site-publications.openapi.yaml