| Method | Path | Summary | Auth |
|---|---|---|---|
| POST | /v1/tenant-scopes/{scope_id}/l4-line-switches | Create an idempotent line-group switch | Session |
| GET | /v1/tenant-scopes/{scope_id}/l4-line-switches/current | Read the latest durable switch for operator recovery | Session |
| GET | /v1/tenant-scopes/{scope_id}/l4-line-switches/{switch_id} | Read durable switch state | Session |
| POST | /v1/tenant-scopes/{scope_id}/l4-line-switches/{switch_id}/reconcile | Advance one idempotent state-machine step from durable facts | Session |
| GET | /v1/tenant-scopes/{scope_id}/sites/{site_id}/telemetry-capture-policy | — | Session |
| PUT | /v1/tenant-scopes/{scope_id}/sites/{site_id}/telemetry-capture-policy | — | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies | List active challenge policies in one tenant scope | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies | Create a challenge policy for a tenant-owned site and host | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id} | Read one challenge policy | Session |
| PATCH | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id} | Append a new challenge policy configuration revision | Session |
| DELETE | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id} | Soft-delete a challenge policy by appending a tombstone revision | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id}/disable | Disable a challenge policy with revision CAS | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id}/enable | Enable a challenge policy with revision CAS | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id}/publications | Publish one exact enabled challenge policy revision to Edge nodes | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id}/publications/{rollout_id} | Read the bounded rollout state for an exact policy artifact | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/challenge-policies/{policy_id}/publications/{rollout_id}/promote | Promote an exact healthy challenge rollout into Edge configuration | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/error-page-publications | 发布租户作用域的错误页配置 | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/error-page-publications/{publication_id} | 读取一个不可变错误页发布结果 | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/http-policies | List non-deleted HTTP policies in one tenant scope | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/http-policies | Create revision one for a tenant-owned site | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/http-policies/publication-preview | Read a deterministic unsigned Edge v1 source snapshot | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/http-policies/{policy_id} | Read one HTTP policy | Session |
| PATCH | /v1/tenant-scopes/{tenant_scope_id}/http-policies/{policy_id} | Append a configuration revision | Session |
| DELETE | /v1/tenant-scopes/{tenant_scope_id}/http-policies/{policy_id} | Soft-delete a policy by appending a tombstone revision | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/http-policies/{policy_id}/disable | Disable a policy with revision CAS | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/http-policies/{policy_id}/enable | Enable a policy with revision CAS | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/credentials | List redacted credential heads in one tenant | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/credentials | Encrypt and append credential revision 1 | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/credentials/{credential_id} | Read one redacted credential head | Session |
| DELETE | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/credentials/{credential_id} | Append a credential tombstone revision | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/credentials/{credential_id}/disable | Append a disabled credential revision | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/credentials/{credential_id}/replace | Encrypt replacement material with the active envelope key | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/credentials/{credential_id}/verify | Invoke the injected verifier and append a verified revision | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/edge-publications | 发布租户作用域的源站鉴权配置 | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/edge-publications/{publication_id} | 读取一个不可变源站鉴权发布结果 | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/publications | Read the latest deterministic secret-free snapshot | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/publications | Append the next tenant publication snapshot | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules | List current rule revisions | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules | Create a tenant, site, and source-bound rule | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules/{rule_id} | Read one current rule revision | Session |
| PATCH | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules/{rule_id} | Append a rule configuration revision | Session |
| DELETE | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules/{rule_id} | Append a rule tombstone revision | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules/{rule_id}/disable | Disable a rule by revision CAS | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules/{rule_id}/enable | Enable a rule after verified credential gates pass | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/origin-auth/rules/{rule_id}/rotate | Schedule current and previous credential cutover | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/plugin-installations | List tenant plugin installation authorization state | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/plugin-installations/{authorization_id} | Read one tenant plugin installation authorization | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-installations/{authorization_id}/confirm | Confirm declared and sensitive plugin scopes before installation | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-installations/{authorization_id}/disable | Protectively disable an installed plugin without consulting License | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-installations/{authorization_id}/uninstall | Revoke local plugin identity and record protective uninstall | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-installations/{authorization_id}/upgrade | Approve a compatible plugin upgrade and any newly declared scopes | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions | List webhook subscriptions | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions | Create a webhook subscription and one-time secret | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id} | Get a webhook subscription | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/deliveries | List subscription deliveries | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/deliveries/{delivery_id} | Get a delivery status | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/deliveries/{delivery_id}/replays | Replay a delivered or dead-lettered delivery | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/delivery-replays | Replay the terminal deliveries of a time range | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/revoke | Revoke a webhook subscription and fence new deliveries | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/secret-rotations | Generate a pending secret rotation | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/secret-rotations/{rotation_id}/activate | Activate a pending secret rotation | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/plugin-webhook-subscriptions/{subscription_id}/test-deliveries | Queue a signed CloudEvents test delivery | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/site-protocol-batches | 批量启用或关闭网站 HTTP/3 | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/site-protocol-batches/{batch_id} | 获取批次、逐站点状态和部分节点结果 | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/site-protocol-batches/{batch_id}/retry | 仅重试批次中的失败站点 | Session |
| POST | /v1/tenant-scopes/{tenant_scope_id}/site-protocol-batches/{batch_id}/rollback | 创建恢复到批次前协议状态的回滚批次 | Session |
| GET | /v1/tenant-scopes/{tenant_scope_id}/theme | — | Session |
| PUT | /v1/tenant-scopes/{tenant_scope_id}/theme | — | Session |
Contract file：api/control-l4-line-switch.openapi.yaml api/control-site-capture.openapi.yaml api/control-challenge-policies.openapi.yaml api/control-error-page-publications.openapi.yaml api/control-http-policies.openapi.yaml api/control-origin-auth.openapi.yaml api/control-origin-auth-publications.openapi.yaml api/control-plugin-installations.openapi.yaml api/control-plugin-webhooks.openapi.yaml api/control-site-protocols.openapi.yaml api/control-themes.openapi.yaml