basePath: /
definitions:
  controller.CleanupConfigVersionRequest:
    properties:
      keep_count:
        minimum: 3
        type: integer
    required:
    - keep_count
    type: object
  controller.DnsAccountInput:
    properties:
      authorization:
        type: string
      name:
        type: string
      type:
        type: string
    type: object
  controller.geoIPLookupRequest:
    properties:
      ip:
        type: string
      provider:
        type: string
    type: object
  controller.optionBatchPayload:
    properties:
      options:
        items:
          $ref: '#/definitions/model.Option'
        type: array
    type: object
  model.Option:
    properties:
      key:
        type: string
      value:
        type: string
    type: object
  service.AgentBufferedObservabilityRecord:
    properties:
      access_logs:
        items:
          $ref: '#/definitions/service.AgentNodeAccessLog'
        type: array
      openresty_observation:
        $ref: '#/definitions/service.AgentNodeOpenrestyObservation'
      snapshot:
        $ref: '#/definitions/service.AgentNodeMetricSnapshot'
      traffic_report:
        $ref: '#/definitions/service.AgentNodeTrafficReport'
      window_started_at_unix:
        type: integer
    type: object
  service.AgentNodeAccessLog:
    properties:
      host:
        type: string
      logged_at_unix:
        type: integer
      path:
        type: string
      remote_addr:
        type: string
      status_code:
        type: integer
    type: object
  service.AgentNodeHealthEvent:
    properties:
      event_type:
        type: string
      message:
        type: string
      metadata:
        additionalProperties:
          type: string
        type: object
      severity:
        type: string
      triggered_at_unix:
        type: integer
    type: object
  service.AgentNodeMetricSnapshot:
    properties:
      captured_at_unix:
        type: integer
      cpu_usage_percent:
        type: number
      disk_read_bytes:
        type: integer
      disk_write_bytes:
        type: integer
      memory_total_bytes:
        type: integer
      memory_used_bytes:
        type: integer
      network_rx_bytes:
        type: integer
      network_tx_bytes:
        type: integer
      storage_total_bytes:
        type: integer
      storage_used_bytes:
        type: integer
    type: object
  service.AgentNodeOpenrestyObservation:
    properties:
      captured_at_unix:
        type: integer
      openresty_connections:
        type: integer
      openresty_rx_bytes:
        type: integer
      openresty_tx_bytes:
        type: integer
    type: object
  service.AgentNodePayload:
    properties:
      access_logs:
        items:
          $ref: '#/definitions/service.AgentNodeAccessLog'
        type: array
      buffered_observability:
        items:
          $ref: '#/definitions/service.AgentBufferedObservabilityRecord'
        type: array
      current_version:
        type: string
      ext_version:
        type: string
      health_events:
        items:
          $ref: '#/definitions/service.AgentNodeHealthEvent'
        type: array
      ip:
        type: string
      last_error:
        type: string
      name:
        type: string
      node_id:
        type: string
      openresty_message:
        type: string
      openresty_observation:
        $ref: '#/definitions/service.AgentNodeOpenrestyObservation'
      openresty_status:
        type: string
      profile:
        $ref: '#/definitions/service.AgentNodeSystemProfile'
      snapshot:
        $ref: '#/definitions/service.AgentNodeMetricSnapshot'
      traffic_report:
        $ref: '#/definitions/service.AgentNodeTrafficReport'
      version:
        type: string
      waf_ip_group_checksums:
        additionalProperties:
          type: string
        type: object
    type: object
  service.AgentNodeSystemProfile:
    properties:
      architecture:
        type: string
      cpu_cores:
        type: integer
      cpu_model:
        type: string
      hostname:
        type: string
      kernel_version:
        type: string
      os_name:
        type: string
      os_version:
        type: string
      reported_at_unix:
        type: integer
      total_disk_bytes:
        type: integer
      total_memory_bytes:
        type: integer
      uptime_seconds:
        type: integer
    type: object
  service.AgentNodeTrafficReport:
    properties:
      error_count:
        type: integer
      request_count:
        type: integer
      source_countries:
        additionalProperties:
          type: integer
        type: object
      status_codes:
        additionalProperties:
          type: integer
        type: object
      top_domains:
        additionalProperties:
          type: integer
        type: object
      unique_visitor_count:
        type: integer
      window_ended_at_unix:
        type: integer
      window_started_at_unix:
        type: integer
    type: object
  service.AgentWAFIPGroupSyncInput:
    properties:
      checksums:
        additionalProperties:
          type: string
        type: object
      ids:
        items:
          type: integer
        type: array
    type: object
  service.ApplyLogPayload:
    properties:
      checksum:
        type: string
      main_config_checksum:
        type: string
      message:
        type: string
      node_id:
        type: string
      result:
        type: string
      route_config_checksum:
        type: string
      support_file_count:
        type: integer
      version:
        type: string
    type: object
  service.FlaredConnectedRelay:
    properties:
      proxy_count:
        type: integer
      relay_node_id:
        type: string
      status:
        type: string
    type: object
  service.FlaredHeartbeatPayload:
    properties:
      client_version:
        type: string
      connected_relays:
        items:
          $ref: '#/definitions/service.FlaredConnectedRelay'
        type: array
      current_checksum:
        type: string
      current_version:
        type: string
      frp_version:
        type: string
      ip:
        type: string
      tunnel_status:
        type: string
    type: object
  service.ManagedDomainInput:
    properties:
      cert_id:
        type: integer
      domain:
        type: string
      enabled:
        type: boolean
      remark:
        type: string
    type: object
  service.NodeInput:
    properties:
      auto_update_enabled:
        type: boolean
      geo_latitude:
        type: number
      geo_longitude:
        type: number
      geo_manual_override:
        type: boolean
      geo_name:
        type: string
      ip:
        type: string
      ip_manual_override:
        type: boolean
      name:
        type: string
      node_type:
        description: TunnelRelay fields
        type: string
      relay_agent_access_addr:
        type: string
      relay_bind_port:
        type: integer
      relay_client_access_addr:
        type: string
      relay_client_proxy_url:
        type: string
      relay_vhost_http_port:
        type: integer
      relay_web_server_enabled:
        type: boolean
    type: object
  service.ProxyRouteCustomHeaderInput:
    properties:
      key:
        type: string
      value:
        type: string
    type: object
  service.ProxyRouteInput:
    properties:
      basic_auth_enabled:
        type: boolean
      basic_auth_password:
        type: string
      basic_auth_username:
        type: string
      cache_enabled:
        type: boolean
      cache_policy:
        type: string
      cache_rules:
        items:
          type: string
        type: array
      cert_id:
        type: integer
      cert_ids:
        items:
          type: integer
        type: array
      custom_headers:
        items:
          $ref: '#/definitions/service.ProxyRouteCustomHeaderInput'
        type: array
      domain:
        type: string
      domain_cert_ids:
        items:
          type: integer
        type: array
      domains:
        items:
          type: string
        type: array
      enable_https:
        type: boolean
      enabled:
        type: boolean
      limit_conn_per_ip:
        type: integer
      limit_conn_per_server:
        type: integer
      limit_rate:
        type: string
      origin_address:
        type: string
      origin_host:
        type: string
      origin_id:
        type: integer
      origin_port:
        type: string
      origin_scheme:
        type: string
      origin_uri:
        type: string
      origin_url:
        type: string
      pow_config:
        type: string
      pow_enabled:
        type: boolean
      redirect_http:
        type: boolean
      remark:
        type: string
      site_name:
        type: string
      tunnel_id:
        type: integer
      tunnel_node_id:
        type: integer
      tunnel_target_addr:
        type: string
      tunnel_target_protocol:
        type: string
      upstream_type:
        type: string
      upstreams:
        items:
          type: string
        type: array
    type: object
  service.RelayHeartbeatPayload:
    properties:
      frp_version:
        type: string
      frps_client_count:
        type: integer
      frps_connections:
        type: integer
      frps_proxies:
        items:
          $ref: '#/definitions/service.RelayProxyStat'
        type: array
      frps_proxy_count:
        type: integer
      health_events:
        items:
          $ref: '#/definitions/service.AgentNodeHealthEvent'
        type: array
      ip:
        type: string
      name:
        type: string
      profile:
        $ref: '#/definitions/service.AgentNodeSystemProfile'
      relay_status:
        type: string
      snapshot:
        $ref: '#/definitions/service.AgentNodeMetricSnapshot'
      version:
        type: string
    type: object
  service.RelayProxyStat:
    properties:
      client_addr:
        type: string
      client_version:
        type: string
      last_close_time:
        type: string
      last_start_time:
        type: string
      name:
        type: string
      status:
        type: string
      type:
        type: string
    type: object
  service.TLSApplyInput:
    properties:
      acme_account_id:
        type: integer
      auto_renew:
        type: boolean
      disable_cname:
        type: boolean
      dns_account_id:
        type: integer
      dns1:
        type: string
      dns2:
        type: string
      key_algorithm:
        type: string
      name:
        type: string
      other_domains:
        type: string
      primary_domain:
        type: string
      remark:
        type: string
      skip_dns:
        type: boolean
    type: object
  service.TLSCertificateInput:
    properties:
      cert_pem:
        type: string
      key_pem:
        type: string
      name:
        type: string
      remark:
        type: string
    type: object
info:
  contact: {}
  description: OpenFlare Server 管理端与 Agent API 文档。
  title: OpenFlare Server API
  version: "3.0"
paths:
  /api/access-logs/:
    get:
      parameters:
      - description: Node ID
        in: query
        name: node_id
        type: string
      - description: Remote address
        in: query
        name: remote_addr
        type: string
      - description: Host
        in: query
        name: host
        type: string
      - description: Path
        in: query
        name: path
        type: string
      - description: Page index
        in: query
        name: p
        type: integer
      - description: Page size
        in: query
        name: page_size
        type: integer
      - description: Sort by
        in: query
        name: sort_by
        type: string
      - description: Sort order
        in: query
        name: sort_order
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List access logs
      tags:
      - AccessLogs
  /api/access-logs/cleanup:
    post:
      consumes:
      - application/json
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Cleanup access logs by retention days
      tags:
      - AccessLogs
  /api/access-logs/folds:
    get:
      parameters:
      - description: Node ID
        in: query
        name: node_id
        type: string
      - description: Remote address
        in: query
        name: remote_addr
        type: string
      - description: Host
        in: query
        name: host
        type: string
      - description: Path
        in: query
        name: path
        type: string
      - description: Page index
        in: query
        name: p
        type: integer
      - description: Page size
        in: query
        name: page_size
        type: integer
      - description: Sort by
        in: query
        name: sort_by
        type: string
      - description: Sort order
        in: query
        name: sort_order
        type: string
      - description: Fold minutes
        in: query
        name: fold_minutes
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List folded access logs
      tags:
      - AccessLogs
  /api/access-logs/folds/ip-summary:
    get:
      parameters:
      - description: Node ID
        in: query
        name: node_id
        type: string
      - description: Remote address
        in: query
        name: remote_addr
        type: string
      - description: Host
        in: query
        name: host
        type: string
      - description: Path
        in: query
        name: path
        type: string
      - description: Bucket started at
        in: query
        name: bucket_started_at
        required: true
        type: string
      - description: Fold minutes
        in: query
        name: fold_minutes
        required: true
        type: integer
      - description: Page index
        in: query
        name: p
        type: integer
      - description: Page size
        in: query
        name: page_size
        type: integer
      - description: Sort by
        in: query
        name: sort_by
        type: string
      - description: Sort order
        in: query
        name: sort_order
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List folded access log IP summaries
      tags:
      - AccessLogs
  /api/access-logs/ip-summary:
    get:
      parameters:
      - description: Node ID
        in: query
        name: node_id
        type: string
      - description: Remote address
        in: query
        name: remote_addr
        type: string
      - description: Host
        in: query
        name: host
        type: string
      - description: Page index
        in: query
        name: p
        type: integer
      - description: Page size
        in: query
        name: page_size
        type: integer
      - description: Sort by
        in: query
        name: sort_by
        type: string
      - description: Sort order
        in: query
        name: sort_order
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List access log IP summaries
      tags:
      - AccessLogs
  /api/access-logs/ip-summary/trend:
    get:
      parameters:
      - description: Node ID
        in: query
        name: node_id
        type: string
      - description: Remote address
        in: query
        name: remote_addr
        required: true
        type: string
      - description: Host
        in: query
        name: host
        type: string
      - description: Hours
        in: query
        name: hours
        type: integer
      - description: Bucket minutes
        in: query
        name: bucket_minutes
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get access log IP trend
      tags:
      - AccessLogs
  /api/acme-accounts/default:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get default ACME account
      tags:
      - AcmeAccounts
  /api/agent/apply-logs:
    post:
      consumes:
      - application/json
      parameters:
      - description: Apply log payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.ApplyLogPayload'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - AccessTokenAuth: []
      summary: Report agent apply result
      tags:
      - Agent
  /api/agent/config-versions/active:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - AccessTokenAuth: []
      summary: Get active config for agent
      tags:
      - Agent
  /api/agent/nodes/heartbeat:
    post:
      consumes:
      - application/json
      parameters:
      - description: Agent heartbeat payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.AgentNodePayload'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - AccessTokenAuth: []
      summary: Report agent heartbeat
      tags:
      - Agent
  /api/agent/nodes/register:
    post:
      consumes:
      - application/json
      parameters:
      - description: Agent node payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.AgentNodePayload'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - AccessTokenAuth: []
      summary: Register or discover agent node
      tags:
      - Agent
  /api/agent/waf/ip-groups/sync:
    post:
      consumes:
      - application/json
      parameters:
      - description: WAF IP group sync payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.AgentWAFIPGroupSyncInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - AccessTokenAuth: []
      summary: Sync WAF IP groups for agent
      tags:
      - Agent
  /api/agent/ws:
    get:
      responses: {}
      security:
      - AccessTokenAuth: []
      summary: Upgrade agent connection to websocket
      tags:
      - Agent
  /api/apply-logs/:
    get:
      parameters:
      - description: Node ID
        in: query
        name: node_id
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List apply logs
      tags:
      - ApplyLogs
  /api/apply-logs/cleanup:
    post:
      consumes:
      - application/json
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Cleanup apply logs
      tags:
      - ApplyLogs
  /api/config-versions/:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List config versions
      tags:
      - ConfigVersions
  /api/config-versions/{id}:
    get:
      parameters:
      - description: Version ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get config version detail
      tags:
      - ConfigVersions
  /api/config-versions/{id}/activate:
    post:
      parameters:
      - description: Version ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Activate an existing config version
      tags:
      - ConfigVersions
  /api/config-versions/active:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get active config version
      tags:
      - ConfigVersions
  /api/config-versions/cleanup:
    post:
      parameters:
      - description: Cleanup request
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/controller.CleanupConfigVersionRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Cleanup old config versions
      tags:
      - ConfigVersions
  /api/config-versions/diff:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Diff current draft against active version
      tags:
      - ConfigVersions
  /api/config-versions/preview:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Preview config rendering
      tags:
      - ConfigVersions
  /api/config-versions/publish:
    post:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Publish a new config version
      tags:
      - ConfigVersions
  /api/dashboard/overview:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get dashboard overview
      tags:
      - Dashboard
  /api/dns-accounts/:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List DNS accounts
      tags:
      - DnsAccounts
    post:
      consumes:
      - application/json
      parameters:
      - description: DNS account payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/controller.DnsAccountInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Create DNS account
      tags:
      - DnsAccounts
  /api/dns-accounts/{id}/delete:
    post:
      parameters:
      - description: DNS Account ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Delete DNS account
      tags:
      - DnsAccounts
  /api/dns-accounts/{id}/update:
    post:
      consumes:
      - application/json
      parameters:
      - description: DNS Account ID
        in: path
        name: id
        required: true
        type: integer
      - description: DNS account payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/controller.DnsAccountInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Update DNS account
      tags:
      - DnsAccounts
  /api/flared/apply-log:
    post:
      consumes:
      - application/json
      parameters:
      - description: Apply log payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.ApplyLogPayload'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - TunnelTokenAuth: []
      summary: Report OpenFlared apply result
      tags:
      - Flared
  /api/flared/config/active:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - TunnelTokenAuth: []
      summary: Get active tunnel config for OpenFlared
      tags:
      - Flared
  /api/flared/heartbeat:
    post:
      consumes:
      - application/json
      parameters:
      - description: Flared heartbeat payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.FlaredHeartbeatPayload'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - TunnelTokenAuth: []
      summary: Report OpenFlared heartbeat
      tags:
      - Flared
  /api/flared/ws:
    get:
      responses: {}
      security:
      - TunnelTokenAuth: []
      summary: Upgrade OpenFlared connection to websocket
      tags:
      - Flared
  /api/managed-domains/:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List managed domains
      tags:
      - ManagedDomains
    post:
      consumes:
      - application/json
      parameters:
      - description: Managed domain payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.ManagedDomainInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Create managed domain
      tags:
      - ManagedDomains
  /api/managed-domains/{id}/delete:
    post:
      parameters:
      - description: Managed domain ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Delete managed domain
      tags:
      - ManagedDomains
  /api/managed-domains/{id}/update:
    post:
      consumes:
      - application/json
      parameters:
      - description: Managed domain ID
        in: path
        name: id
        required: true
        type: integer
      - description: Managed domain payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.ManagedDomainInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Update managed domain
      tags:
      - ManagedDomains
  /api/managed-domains/match:
    get:
      parameters:
      - description: Domain
        in: query
        name: domain
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Match certificate for domain
      tags:
      - ManagedDomains
  /api/nodes/:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List nodes
      tags:
      - Nodes
    post:
      consumes:
      - application/json
      parameters:
      - description: Node payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.NodeInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Create node
      tags:
      - Nodes
  /api/nodes/{id}/agent-release:
    get:
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      - description: stable or preview
        in: query
        name: channel
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Check latest agent release for node
      tags:
      - Nodes
  /api/nodes/{id}/agent-update:
    post:
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Request agent self-update on node
      tags:
      - Nodes
  /api/nodes/{id}/delete:
    post:
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Delete node
      tags:
      - Nodes
  /api/nodes/{id}/force-sync:
    post:
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Request force sync config on node
      tags:
      - Nodes
  /api/nodes/{id}/observability:
    get:
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      - description: Lookback window in hours
        in: query
        name: hours
        type: integer
      - description: Max records per section
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get node observability details
      tags:
      - Nodes
  /api/nodes/{id}/observability/cleanup:
    post:
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Cleanup node health events
      tags:
      - Nodes
  /api/nodes/{id}/openresty-restart:
    post:
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Request openresty restart on node
      tags:
      - Nodes
  /api/nodes/{id}/update:
    post:
      consumes:
      - application/json
      parameters:
      - description: Node ID
        in: path
        name: id
        required: true
        type: integer
      - description: Node payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.NodeInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Update node
      tags:
      - Nodes
  /api/nodes/bootstrap-token:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get global discovery token
      tags:
      - Nodes
  /api/nodes/bootstrap-token/rotate:
    post:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Rotate global discovery token
      tags:
      - Nodes
  /api/option/:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      summary: List editable options
      tags:
      - Options
  /api/option/database/cleanup:
    post:
      consumes:
      - application/json
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Cleanup observability tables
      tags:
      - Options
  /api/option/geoip/lookup:
    post:
      consumes:
      - application/json
      parameters:
      - description: GeoIP lookup payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/controller.geoIPLookupRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      summary: Test GeoIP lookup
      tags:
      - Options
  /api/option/update:
    post:
      consumes:
      - application/json
      parameters:
      - description: Option payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/model.Option'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      summary: Update option
      tags:
      - Options
  /api/option/update-batch:
    post:
      consumes:
      - application/json
      parameters:
      - description: Batch option payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/controller.optionBatchPayload'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      summary: Batch update options
      tags:
      - Options
  /api/proxy-routes/:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List proxy routes
      tags:
      - ProxyRoutes
    post:
      consumes:
      - application/json
      parameters:
      - description: Proxy route payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.ProxyRouteInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Create proxy route
      tags:
      - ProxyRoutes
  /api/proxy-routes/{id}:
    get:
      parameters:
      - description: Route ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get proxy route detail
      tags:
      - ProxyRoutes
  /api/proxy-routes/{id}/delete:
    post:
      parameters:
      - description: Route ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Delete proxy route
      tags:
      - ProxyRoutes
  /api/proxy-routes/{id}/update:
    post:
      consumes:
      - application/json
      parameters:
      - description: Route ID
        in: path
        name: id
        required: true
        type: integer
      - description: Proxy route payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.ProxyRouteInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Update proxy route
      tags:
      - ProxyRoutes
  /api/relay/heartbeat:
    post:
      consumes:
      - application/json
      parameters:
      - description: Relay heartbeat payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.RelayHeartbeatPayload'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - AccessTokenAuth: []
      summary: Report relay heartbeat
      tags:
      - Relay
  /api/relay/ws:
    get:
      responses: {}
      security:
      - AccessTokenAuth: []
      summary: Upgrade relay connection to websocket
      tags:
      - Relay
  /api/status:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      summary: Get server status
      tags:
      - Public
  /api/tls-certificates/:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: List TLS certificates
      tags:
      - TLSCertificates
    post:
      consumes:
      - application/json
      parameters:
      - description: TLS certificate payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.TLSCertificateInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Create TLS certificate from PEM
      tags:
      - TLSCertificates
  /api/tls-certificates/{id}:
    get:
      parameters:
      - description: Certificate ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get TLS certificate detail
      tags:
      - TLSCertificates
  /api/tls-certificates/{id}/content:
    get:
      parameters:
      - description: Certificate ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get TLS certificate PEM content
      tags:
      - TLSCertificates
  /api/tls-certificates/{id}/convert-acme:
    post:
      consumes:
      - application/json
      parameters:
      - description: Certificate ID
        in: path
        name: id
        required: true
        type: integer
      - description: TLS apply payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.TLSApplyInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Convert uploaded TLS certificate to ACME managed certificate
      tags:
      - TLSCertificates
  /api/tls-certificates/{id}/delete:
    post:
      parameters:
      - description: Certificate ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Delete TLS certificate
      tags:
      - TLSCertificates
  /api/tls-certificates/{id}/renew:
    post:
      parameters:
      - description: Certificate ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Renew TLS certificate
      tags:
      - TLSCertificates
  /api/tls-certificates/{id}/update:
    post:
      consumes:
      - application/json
      parameters:
      - description: Certificate ID
        in: path
        name: id
        required: true
        type: integer
      - description: TLS certificate payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.TLSCertificateInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Update TLS certificate from PEM
      tags:
      - TLSCertificates
  /api/tls-certificates/{id}/update-acme:
    post:
      consumes:
      - application/json
      parameters:
      - description: Certificate ID
        in: path
        name: id
        required: true
        type: integer
      - description: TLS apply payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.TLSApplyInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Update ACME TLS certificate
      tags:
      - TLSCertificates
  /api/tls-certificates/apply:
    post:
      consumes:
      - application/json
      parameters:
      - description: TLS apply payload
        in: body
        name: payload
        required: true
        schema:
          $ref: '#/definitions/service.TLSApplyInput'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Apply TLS certificate via ACME
      tags:
      - TLSCertificates
  /api/tls-certificates/import-file:
    post:
      consumes:
      - multipart/form-data
      parameters:
      - description: Certificate name
        in: formData
        name: name
        required: true
        type: string
      - description: Remark
        in: formData
        name: remark
        type: string
      - description: Certificate file
        in: formData
        name: cert_file
        required: true
        type: file
      - description: Private key file
        in: formData
        name: key_file
        required: true
        type: file
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Import TLS certificate from files
      tags:
      - TLSCertificates
  /api/update/latest-release:
    get:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      security:
      - BearerAuth: []
      summary: Get latest GitHub release
      tags:
      - Update
  /api/update/logs/ws:
    get:
      responses: {}
      summary: Stream server upgrade logs over websocket
      tags:
      - Update
  /api/update/manual-upgrade:
    post:
      consumes:
      - application/json
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      summary: Confirm upgrade with previously uploaded server binary
      tags:
      - Update
  /api/update/manual-upload:
    post:
      consumes:
      - multipart/form-data
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      summary: Upload server binary and inspect version before upgrade
      tags:
      - Update
  /api/update/upgrade:
    post:
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
      summary: Upgrade server binary from latest GitHub release
      tags:
      - Update
schemes:
- http
- https
securityDefinitions:
  AccessTokenAuth:
    description: Agent API 使用节点专属 Agent Token 或全局 Discovery Token
    in: header
    name: X-Agent-Token
    type: apiKey
  BearerAuth:
    description: 管理端可使用 Bearer Token，例如：Bearer <token>
    in: header
    name: Authorization
    type: apiKey
swagger: "2.0"