API7 Enterprise Admin APIs are RESTful APIs that allow you to create, configure, and manage all API7 Enterprise resources programmatically. These APIs power the API7 Dashboard and can be used...
GET List all services on a gateway group /apisix/admin/servicesList services through an APISIX Admin API compatible endpoint under /apisix/admin/. Use this to browse APISIX-formatted service objects in a gateway group. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
POST Create a service on a gateway group /apisix/admin/servicesCreate a service through an APISIX Admin API compatible endpoint under /apisix/admin/. The payload follows APISIX conventions while operating on the same underlying service resource managed by dashboard APIs. Required IAM Permission: Action gateway:CreatePublishedService...
GET Get a service on a gateway group /apisix/admin/services/{service_id}Get one service through an APISIX Admin API compatible endpoint under /apisix/admin/. The response keeps APISIX field conventions for migration and interoperability scenarios. Required IAM Permission: Action gateway:GetPublishedService, Resource...
PUT Update a service directly /apisix/admin/services/{service_id}Fully update a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This replaces the stored service configuration. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
DELETE Delete a service on a gateway group /apisix/admin/services/{service_id}Delete a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Removing this object affects all APISIX-compatible references to the service in that gateway group. Required IAM Permission: Action gateway:DeletePublishedService, Resource...
PATCH Patch a service on a gateway group /apisix/admin/services/{service_id}Partially update a service via JSON Patch (RFC 6902) through an APISIX Admin API compatible endpoint under /apisix/admin/. Use this for targeted field changes. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
GET Get the OpenAPI Specification of a service /api/gateway_groups/{gateway_group_id}/services/{apisix_service_id}/oasGet the OAS document for a service. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PUT Update the OpenAPI Specification of a service /api/gateway_groups/{gateway_group_id}/services/{apisix_service_id}/oasUpdate the OAS document for a service. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
GET List all upstreams in a service on a gateway group /apisix/admin/services/{service_id}/upstreamsList upstreams attached to a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Use this to inspect backend pools and their current settings. Required IAM Permission: Action gateway:GetPublishedService, Resource...
POST Create an upstream in a service on a gateway group /apisix/admin/services/{service_id}/upstreamsCreate an upstream within a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This adds backend target configuration in APISIX format. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
GET Get an upstream in a service on a gateway group /apisix/admin/services/{service_id}/upstreams/{upstream_id}Get one upstream in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. The response uses APISIX-style upstream structure. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PUT Update an upstream in a service on a gateway group /apisix/admin/services/{service_id}/upstreams/{upstream_id}Fully update an upstream in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Submit the complete upstream object to replace existing configuration. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
DELETE Delete an upstream in a service on a gateway group /apisix/admin/services/{service_id}/upstreams/{upstream_id}Delete an upstream from a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This updates service backend routing targets without deleting the service itself. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
PATCH Patch an upstream in a service on a gateway group /apisix/admin/services/{service_id}/upstreams/{upstream_id}Partially update an upstream in a service via JSON Patch (RFC 6902) through an APISIX Admin API compatible endpoint under /apisix/admin/. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
POST Generate an OpenAPI specification from services in a gateway group /api/gateway_groups/{gateway_group_id}/services/exportExport service definitions from a specific gateway group as an OpenAPI 3.0 specification document. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/
POST Import services based on OpenAPI Specification /api/import/servicesImport an OpenAPI specification directly into services for a gateway group. This operation creates runtime service resources scoped to the target gateway group. Required IAM Permission: Action gateway:CreatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/
PUT Convert OpenAPI Specification to service and route resources /api/openapi/convertConvert a given OpenAPI Specification into service and route resource structures without creating those resources. Use this endpoint for preview, validation, and transformation workflows before import.
GET List all routes in a service /apisix/admin/routesList routes in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Use pagination and filters to inspect APISIX-compatible route entries. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
POST Create a route in a service on a gateway group /apisix/admin/routesCreate a route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This adds APISIX-formatted HTTP routing rules on shared dashboard resources. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
GET Get a route in a service on a gateway group /apisix/admin/routes/{route_id}Get one route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This returns the route with APISIX field format. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PUT Update a route in a service on a gateway group /apisix/admin/routes/{route_id}Fully update a route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Use this when replacing the entire route object. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
DELETE Delete a route in a service on a gateway group /apisix/admin/routes/{route_id}Delete a route from a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Requests that matched this rule will no longer be routed by it. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PATCH Patch a route in a service on a gateway group /apisix/admin/routes/{route_id}Partially update a route in a service via JSON Patch (RFC 6902) through an APISIX Admin API compatible endpoint under /apisix/admin/. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
GET List all stream routes in a service on a gateway group /apisix/admin/stream_routesList stream routes in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Use this for visibility into current L4 routing rules. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
POST Create a stream route in a service on a gateway group /apisix/admin/stream_routesCreate a stream route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This configures APISIX-style TCP/UDP traffic matching rules. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
GET Get a stream route in a service on a gateway group /apisix/admin/stream_routes/{stream_route_id}Get one stream route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. The returned object matches APISIX stream-route conventions. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PUT Update a stream route in a service on a gateway group /apisix/admin/stream_routes/{stream_route_id}Fully update a stream route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This replaces the existing stream-route configuration. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
DELETE Delete a stream route in a service on a gateway group /apisix/admin/stream_routes/{stream_route_id}Delete a stream route from a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This removes a specific L4 route while preserving other service objects. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
GET Get healthcheck status for the upstream of a service on a gateway group, if upstream_id is not provided, get healthcheck status for default upstream of this service /api/gateway_groups/{gateway_group_id}/services/{apisix_service_id}/healthcheckRetrieve upstream node health check results for a service in a gateway group. If no upstream ID is provided, the status of the service's default upstream is returned. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
GET List all services connected to a service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/connected_servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all routes in a service /apisix/admin/routesList routes in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Use pagination and filters to inspect APISIX-compatible route entries. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
POST Create a route in a service on a gateway group /apisix/admin/routesCreate a route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This adds APISIX-formatted HTTP routing rules on shared dashboard resources. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
GET Get a route in a service on a gateway group /apisix/admin/routes/{route_id}Get one route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This returns the route with APISIX field format. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PUT Update a route in a service on a gateway group /apisix/admin/routes/{route_id}Fully update a route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Use this when replacing the entire route object. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
DELETE Delete a route in a service on a gateway group /apisix/admin/routes/{route_id}Delete a route from a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Requests that matched this rule will no longer be routed by it. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PATCH Patch a route in a service on a gateway group /apisix/admin/routes/{route_id}Partially update a route in a service via JSON Patch (RFC 6902) through an APISIX Admin API compatible endpoint under /apisix/admin/. Required IAM Permission: Action gateway:UpdatePublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
GET List all stream routes in a service on a gateway group /apisix/admin/stream_routesList stream routes in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. Use this for visibility into current L4 routing rules. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
POST Create a stream route in a service on a gateway group /apisix/admin/stream_routesCreate a stream route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This configures APISIX-style TCP/UDP traffic matching rules. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
GET Get a stream route in a service on a gateway group /apisix/admin/stream_routes/{stream_route_id}Get one stream route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. The returned object matches APISIX stream-route conventions. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
PUT Update a stream route in a service on a gateway group /apisix/admin/stream_routes/{stream_route_id}Fully update a stream route in a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This replaces the existing stream-route configuration. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
DELETE Delete a stream route in a service on a gateway group /apisix/admin/stream_routes/{stream_route_id}Delete a stream route from a service through an APISIX Admin API compatible endpoint under /apisix/admin/. This removes a specific L4 route while preserving other service objects. Required IAM Permission: Action gateway:UpdatePublishedService, Resource...
GET List all consumers on a gateway group /apisix/admin/consumersIAM Action: gateway:GetConsumer, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
POST Create a consumer on a gateway group /apisix/admin/consumersIAM Action: gateway:CreateConsumer, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/
GET Get a consumer on a gateway group /apisix/admin/consumers/{username}IAM Action: gateway:GetConsumer, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
PUT Update a consumer on a gateway group /apisix/admin/consumers/{username}IAM Action: gateway:UpdateConsumer, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
DELETE Delete a consumer /apisix/admin/consumers/{username}IAM Action: gateway:DeleteConsumer, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
PATCH Update a consumer on a gateway group /apisix/admin/consumers/{username}IAM Action: gateway:UpdateConsumer, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
GET List all consumer credentials on a gateway group /apisix/admin/consumers/{username}/credentialsIAM Action: gateway:GetConsumerCredential, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
POST Create a consumer credential on a gateway group /apisix/admin/consumers/{username}/credentialsIAM Action: gateway:CreateConsumerCredential, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
GET Get a consumer credential on a gateway group /apisix/admin/consumers/{username}/credentials/{credential_id}IAM Action: gateway:GetConsumerCredential, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
PUT Update a consumer credential on a gateway group /apisix/admin/consumers/{username}/credentials/{credential_id}IAM Action: gateway:UpdateConsumerCredential, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
DELETE Delete a consumer credential /apisix/admin/consumers/{username}/credentials/{credential_id}IAM Action: gateway:DeleteConsumerCredential, Resource: arn:api7:gateway:gatewaygroup/%s/consumer/%s
POST Check service route conflicts in a gateway group /api/gateway_groups/{gateway_group_id}/services/conflict_checkCheck for duplicate or overlapping routes among services within a gateway group.
GET List all gateway instances on a gateway group /api/gateway_groups/{gateway_group_id}/instancesIAM Action: gateway:GetGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Count the number of gateway instances by status in a gateway group /api/instances/count/{field}IAM Action: gateway:GetGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Export the gateway instance core usage /api/instances/cores_usages/exportThe gateway instance’s core usage is exported hourly within the specified time interval. IAM Action: gateway:GetGatewayInstanceCore, Resource: arn:api7:gateway:gatewaygroup/
GET List all gateway groups /api/gateway_groupsIAM Action: gateway:GetGatewayGroup, Resource: arn:api7:gateway:gatewaygroup/%s
POST Create a gateway group /api/gateway_groupsIAM Action: gateway:CreateGatewayGroup, Resource: arn:api7:gateway:gatewaygroup/%s
GET Count resources by type in each gateway group /api/gateway_groups/count/{resource_type}GET List SSL Usage in a gateway group /api/gateway_groups/{gateway_group_id}/ssls/{ssl_id}/usageIAM Action: gateway:GetSSLCertificate, Resource: arn:api7:gateway:gatewaygroup/%s
GET List SNI Usage in a gateway group /api/gateway_groups/{gateway_group_id}/snis/{sni_id}/usageIAM Action: gateway:GetSNI, Resource: arn:api7:gateway:gatewaygroup/%s
GET List Certificate Usage in a gateway group /api/gateway_groups/{gateway_group_id}/certificates/{certificate_id}/usageIAM Action: gateway:GetCertificate, Resource: arn:api7:gateway:gatewaygroup/%s
GET List CA Certificate Usage in a gateway group /api/gateway_groups/{gateway_group_id}/ca_certificates/{ca_certificate_id}/usageIAM Action: gateway:GetCACertificate, Resource: arn:api7:gateway:gatewaygroup/%s
POST Check if a certificate exists in a gateway group /api/gateway_groups/{gateway_group_id}/certificates/existsIAM Action: gateway:GetCACertificate, Resource: arn:api7:gateway:gatewaygroup/%s
POST Check if a CA certificate exists in a gateway group /api/gateway_groups/{gateway_group_id}/ca_certificates/existsIAM Action: gateway:GetCACertificate, Resource: arn:api7:gateway:gatewaygroup/%s
GET List Secret Provider Usage in a gateway group /api/gateway_groups/{gateway_group_id}/secret_providers/{secret_provider}/{secret_provider_id}/usageIAM Action: gateway:GetSecretProvider, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get a gateway group /api/gateway_groups/{gateway_group_id}IAM Action: gateway:GetGatewayGroup, Resource: arn:api7:gateway:gatewaygroup/%s
PUT Update a gateway group /api/gateway_groups/{gateway_group_id}IAM Action: gateway:UpdateGatewayGroup, Resource: arn:api7:gateway:gatewaygroup/%s
DELETE Delete a gateway group /api/gateway_groups/{gateway_group_id}IAM Action: gateway:DeleteGatewayGroup, Resource: arn:api7:gateway:gatewaygroup/%s
POST Get resource paths /api/gateway_groups/{gateway_group_id}/resource_pathsResolve resource IDs to ordered business resource paths on demand. IAM Action: gateway:GetGatewayGroup, Resource: arn:api7:gateway:gatewaygroup/%s
GET List monitored shared dictionaries of a gateway group /api/gateway_groups/{gateway_group_id}/shared_dict_namesList the shared dictionaries (shared memory zones) worth monitoring for a gateway group, i.e. every shared dict the data plane reports metrics for minus the ones on the alert denylist (lock dicts and LRU caches).
GET Get the admin key for a gateway group. /api/gateway_groups/{gateway_group_id}/admin_keyIAM Action: gateway:GetAdminKey, Resource: arn:api7:gateway:gatewaygroup/%s
PUT Generate an admin key for a gateway group /api/gateway_groups/{gateway_group_id}/admin_keyIAM Action: gateway:UpdateGatewayGroup, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install the gateway instance by Docker /api/gateway_groups/{gateway_group_id}/deployment/dockerIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install the gateway instance by Docker Compose /api/gateway_groups/{gateway_group_id}/deployment/docker-composeIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install the gateway instance by Helm in Kubernetes /api/gateway_groups/{gateway_group_id}/deployment/helm/scriptIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a values file for the gateway's Kubernetes Helm chart /api/gateway_groups/{gateway_group_id}/deployment/helm/yamlIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install the gateway instance by RPM /api/gateway_groups/{gateway_group_id}/deployment/rpmIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install gateway API resources for ingress gateway group /api/gateway_groups/{gateway_group_id}/ingress/scriptIAM Action: gateway:GetAdminKey, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate script to install the gateway api resources for ingress gateway group. /api/gateway_groups/{gateway_group_id}/ingress/step1POST Issue a data plane certificate on a gateway group /api/gateway_groups/{gateway_group_id}/dp_client_certificatesIssue a client TLS certificate for data plane instances in the specified gateway group to authenticate with the control plane. Use this during gateway bootstrap or certificate rotation. Required IAM Permission: Action gateway:CreateGatewayInstance, Resource...
GET Get healthcheck status for the upstream of a service on a gateway group, if upstream_id is not provided, get healthcheck status for default upstream of this service /api/gateway_groups/{gateway_group_id}/services/{apisix_service_id}/healthcheckRetrieve upstream node health check results for a service in a gateway group. If no upstream ID is provided, the status of the service's default upstream is returned. Required IAM Permission: Action gateway:GetPublishedService, Resource arn:api7:gateway:gatewaygroup/%s/service/%s
GET List all service registry connections on a gateway group /api/gateway_groups/{gateway_group_id}/service_registriesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
POST Create a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registriesIAM Action: gateway:ConnectServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
POST Create a token for all gateway instances in a gateway group /api/gateway_groups/{gateway_group_id}/instance_tokenIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}IAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
PUT Update a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}IAM Action: gateway:UpdateServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
DELETE Delete a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}IAM Action: gateway:DisconnectServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all services connected to a service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/connected_servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all internal services in a Kubernetes service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/kubernetes/internal_servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all namespaces in a Nacos service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespacesGET List all groups in a Nacos namespace /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespaces/{nacos_namespace}/groupsIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all internal services in a Nacos group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespaces/{nacos_namespace}/groups/{nacos_group}/servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get all instance metadata of a Nacos services registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespaces/{nacos_namespace}/groups/{nacos_group}/services/{nacos_service}/instances_metadataIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all datacenters in a Consul service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/consul/datacentersIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all services in a Consul datacenter /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/consul/datacenters/{consul_datacenter}/servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get all instance metadata of a Consul service /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/consul/datacenters/{consul_datacenter}/services/{consul_service}/instances_metadataIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get health check history of a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/health_check_historyIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all gateway instances of all gateway groups /api/instancesIAM Action: gateway:GetGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all gateway instances on a gateway group /api/gateway_groups/{gateway_group_id}/instancesIAM Action: gateway:GetGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Count the number of gateway instances by status in a gateway group /api/instances/count/{field}IAM Action: gateway:GetGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET List gateway instances cores of all gateway groups /api/instances/coresIAM Action: gateway:GetGatewayInstanceCore, Resource: arn:api7:gateway:gatewaygroup/
GET Export the gateway instance core usage /api/instances/cores_usages/exportThe gateway instance’s core usage is exported hourly within the specified time interval. IAM Action: gateway:GetGatewayInstanceCore, Resource: arn:api7:gateway:gatewaygroup/
GET Generate a script to install the gateway instance by Docker /api/gateway_groups/{gateway_group_id}/deployment/dockerIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install the gateway instance by Docker Compose /api/gateway_groups/{gateway_group_id}/deployment/docker-composeIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install the gateway instance by Helm in Kubernetes /api/gateway_groups/{gateway_group_id}/deployment/helm/scriptIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a values file for the gateway's Kubernetes Helm chart /api/gateway_groups/{gateway_group_id}/deployment/helm/yamlIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET Generate a script to install the gateway instance by RPM /api/gateway_groups/{gateway_group_id}/deployment/rpmIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
DELETE Delete gateway instance /api/gateway_groups/{gateway_group_id}/instances/{gateway_instance_id}IAM Action: gateway:DeleteGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
POST Issue a data plane certificate on a gateway group /api/gateway_groups/{gateway_group_id}/dp_client_certificatesIssue a client TLS certificate for data plane instances in the specified gateway group to authenticate with the control plane. Use this during gateway bootstrap or certificate rotation. Required IAM Permission: Action gateway:CreateGatewayInstance, Resource...
POST Create a token for all gateway instances in a gateway group /api/gateway_groups/{gateway_group_id}/instance_tokenIAM Action: gateway:CreateGatewayInstance, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all SSL certificates on a gateway group /apisix/admin/sslsIAM Action: gateway:GetSSLCertificate, Resource: arn:api7:gateway:gatewaygroup/%s
POST Create an SSL certificate /apisix/admin/sslsIAM Action: gateway:CreateSSLCertificate, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get an SSL certificate on a gateway group /apisix/admin/ssls/{ssl_id}IAM Action: gateway:GetSSLCertificate, Resource: arn:api7:gateway:gatewaygroup/%s
PUT Update an SSL certificate on a gateway group /apisix/admin/ssls/{ssl_id}IAM Action: gateway:UpdateSSLCertificate, Resource: arn:api7:gateway:gatewaygroup/%s
DELETE Delete an SSL certificate on a gateway group /apisix/admin/ssls/{ssl_id}IAM Action: gateway:DeleteSSLCertificate, Resource: arn:api7:gateway:gatewaygroup/%s
PUT Parse an SSL certificate /api/parse_certificatePUT Validate an SSL certificate and key /api/validate_cert_keyGET List all certificates on a gateway group /apisix/admin/certificatesList TLS server certificates configured in the gateway group. Use filters such as labels, related SNI, expiration time, and search keywords to find certificates for rotation or troubleshooting. Required IAM Permission: Action gateway:GetCertificate, Resource...
POST Create a certificate /apisix/admin/certificatesCreate a TLS server certificate for the gateway group, including the certificate chain and private key used for HTTPS termination. Required IAM Permission: Action gateway:CreateCertificate, Resource arn:api7:gateway:gatewaygroup/%s
GET Get a certificate on a gateway group /apisix/admin/certificates/{certificate_id}Retrieve details of a specific TLS server certificate in the gateway group, including its configured metadata and bindings. Required IAM Permission: Action gateway:GetCertificate, Resource arn:api7:gateway:gatewaygroup/%s
PUT Update a certificate on a gateway group /apisix/admin/certificates/{certificate_id}Replace the full configuration of an existing TLS server certificate in the gateway group. This operation may impact HTTPS traffic using this certificate. Required IAM Permission: Action gateway:UpdateCertificate, Resource arn:api7:gateway:gatewaygroup/%s
DELETE Delete a certificate on a gateway group /apisix/admin/certificates/{certificate_id}Delete a TLS server certificate from the gateway group. Ensure no active SNI or route still depends on this certificate before removal. Required IAM Permission: Action gateway:DeleteCertificate, Resource arn:api7:gateway:gatewaygroup/%s
PATCH Patch a certificate on a gateway group /apisix/admin/certificates/{certificate_id}Partially update fields of a TLS server certificate using JSON Patch (RFC 6902). Use this when adjusting selected attributes without replacing the entire certificate object. Required IAM Permission: Action gateway:UpdateCertificate, Resource arn:api7:gateway:gatewaygroup/%s
GET List all CA certificates on a gateway group /apisix/admin/ca_certificatesList CA certificates configured for mTLS client certificate verification in the gateway group. Use query filters to locate certificates by labels, expiration, or associated SNI. Required IAM Permission: Action gateway:GetCertificate, Resource arn:api7:gateway:gatewaygroup/%s
POST Create a CA certificate /apisix/admin/ca_certificatesCreate a CA certificate used to verify client certificates during mTLS handshakes in the gateway group. Required IAM Permission: Action gateway:CreateCertificate, Resource arn:api7:gateway:gatewaygroup/%s
GET Get a CA certificate on a gateway group /apisix/admin/ca_certificates/{ca_certificate_id}Retrieve details of a specific CA certificate configured in the gateway group for mTLS validation. Required IAM Permission: Action gateway:GetCertificate, Resource arn:api7:gateway:gatewaygroup/%s
PUT Update a CA certificate on a gateway group /apisix/admin/ca_certificates/{ca_certificate_id}Replace the full configuration of an existing CA certificate used for client certificate verification. Changes can affect mTLS authentication for related traffic. Required IAM Permission: Action gateway:UpdateCertificate, Resource arn:api7:gateway:gatewaygroup/%s
DELETE Delete a CA certificate on a gateway group /apisix/admin/ca_certificates/{ca_certificate_id}Delete a CA certificate from the gateway group. Confirm no active mTLS SNI or client verification flow still relies on this certificate. Required IAM Permission: Action gateway:DeleteCertificate, Resource arn:api7:gateway:gatewaygroup/%s
PATCH Patch a CA certificate on a gateway group /apisix/admin/ca_certificates/{ca_certificate_id}Partially update a CA certificate with JSON Patch (RFC 6902) operations. Use patching for targeted changes without sending the full CA certificate payload. Required IAM Permission: Action gateway:UpdateCertificate, Resource arn:api7:gateway:gatewaygroup/%s
GET List all SNIs on a gateway group /apisix/admin/snisList SNI configurations for the gateway group, including hostname and mTLS related settings. Use filters to locate entries by domain, labels, or mTLS enablement. Required IAM Permission: Action gateway:GetSNI, Resource arn:api7:gateway:gatewaygroup/%s
POST Create an SNI /apisix/admin/snisCreate an SNI entry that maps one or more hostnames to TLS certificates in the gateway group. This allows a single gateway to serve multiple domains over HTTPS. Required IAM Permission: Action gateway:CreateSNI, Resource arn:api7:gateway:gatewaygroup/%s
GET Get an SNI on a gateway group /apisix/admin/snis/{sni_id}Retrieve the configuration of a specific SNI entry in the gateway group, including bound domains and certificate references. Required IAM Permission: Action gateway:GetSNI, Resource arn:api7:gateway:gatewaygroup/%s
PUT Update an SNI on a gateway group /apisix/admin/snis/{sni_id}Replace an existing SNI configuration in full, such as domain mappings, certificate bindings, or mTLS options. Updates take effect on TLS handshakes for matching hostnames. Required IAM Permission: Action gateway:UpdateSNI, Resource arn:api7:gateway:gatewaygroup/%s
DELETE Delete an SNI on a gateway group /apisix/admin/snis/{sni_id}Delete an SNI entry from the gateway group to remove its hostname-to- certificate mapping. Verify that traffic for those domains has a replacement SNI before deletion. Required IAM Permission: Action gateway:DeleteSNI, Resource arn:api7:gateway:gatewaygroup/%s
PATCH Patch an SNI on a gateway group /apisix/admin/snis/{sni_id}Partially update selected SNI fields using JSON Patch (RFC 6902). This is useful for incremental hostname or certificate adjustments without replacing the entire SNI object. Required IAM Permission: Action gateway:UpdateSNI, Resource arn:api7:gateway:gatewaygroup/%s
GET List all global rules on a gateway group /apisix/admin/global_rulesList global plugin rules configured for the gateway group. This helps audit request-wide policies and understand which plugins are enforced universally. Required IAM Permission: Action gateway:GetGlobalPluginRule, Resource arn:api7:gateway:gatewaygroup/%s
POST Create a global rule on a gateway group /apisix/admin/global_rulesCreate a global rule that applies plugin configuration to all requests in the gateway group. Use this for cross-cutting behavior such as global authentication, logging, or rate controls. Required IAM Permission: Action gateway:CreateGlobalPluginRule, Resource...
GET Get a global rule on a gateway group /apisix/admin/global_rules/{global_rule_id}Retrieve one global rule in the gateway group, including its plugin configuration and execution settings. Required IAM Permission: Action gateway:GetGlobalPluginRule, Resource arn:api7:gateway:gatewaygroup/%s
PUT Update a global rule on a gateway group /apisix/admin/global_rules/{global_rule_id}Replace an existing global rule configuration in full for the gateway group. Changes immediately affect all matching traffic because global rules are applied gateway-wide. Required IAM Permission: Action gateway:UpdateGlobalPluginRule, Resource arn:api7:gateway:gatewaygroup/%s
DELETE Delete a global rule on a gateway group /apisix/admin/global_rules/{global_rule_id}Delete a global rule from the gateway group, removing its plugin behavior from all requests. Review related route or service plugin configuration if equivalent controls are still required. Required IAM Permission: Action gateway:DeleteGlobalPluginRule, Resource...
GET Get all plugin schemas and priorities /apisix/admin/pluginsGET List all plugin names /apisix/admin/plugins/listGET Get schema definition of a plugin /apisix/admin/plugins/{plugin_name}Get schema definition of a plugin, including plugin meta properties and plugin properties. The endpoint returns the same response as the /apisix/admin/schema/plugins/{plugin name} endpoint when scope is not set.
GET Get schema definition of a plugin /apisix/admin/schema/plugins/{plugin_name}Get schema definition of a plugin, including plugin meta properties and plugin properties.
GET Get all plugin details /api/pluginsGET List all plugin catalogs /api/plugins/catalogsGET Get the usage of a plugin in all gateway groups /api/plugins/{plugin_name}/usageGET List all plugin metadata on a gateway group /apisix/admin/plugin_metadataList plugin metadata objects configured in the gateway group. Plugin metadata provides shared settings for a plugin type across all its instances. Required IAM Permission: Action gateway:GetPluginMetadata, Resource arn:api7:gateway:gatewaygroup/%s
GET Get a plugin metadata on a gateway group /apisix/admin/plugin_metadata/{plugin_name}Retrieve metadata for a specific plugin type in the gateway group. You can optionally request default metadata values for comparison. Required IAM Permission: Action gateway:GetPluginMetadata, Resource arn:api7:gateway:gatewaygroup/%s
PUT Update a plugin metadata on a gateway group /apisix/admin/plugin_metadata/{plugin_name}Update the shared metadata configuration for a specific plugin type in the gateway group. The change affects behavior of all plugin instances that consume this metadata. Required IAM Permission: Action gateway:UpdatePluginMetadata, Resource arn:api7:gateway:gatewaygroup/%s
DELETE Delete a plugin metadata on a gateway group /apisix/admin/plugin_metadata/{plugin_name}Delete metadata for a specific plugin type in the gateway group and revert to plugin defaults where applicable. Validate downstream plugin behavior after removal. Required IAM Permission: Action gateway:DeletePluginMetadata, Resource arn:api7:gateway:gatewaygroup/%s
GET Get the default value of a plugin metadata /apisix/admin/plugin_metadata/{plugin_name}/defaultGET List all custom plugins /api/custom_pluginsList all uploaded custom plugins available in the current scope. Use pagination and search parameters to locate plugin packages by name or metadata. Required IAM Permission: Action gateway:GetCustomPlugin, Resource arn:api7:gateway:gatewaysetting/
POST Create a custom plugin /api/custom_pluginsUpload and create a new custom plugin package, such as a Lua script plugin or WebAssembly module. After creation, the plugin can be selected in gateway configurations. Required IAM Permission: Action gateway:CreateCustomPlugin, Resource arn:api7:gateway:gatewaysetting/
GET Get a custom plugin /api/custom_plugins/{custom_plugin_id}Retrieve metadata and configuration of a specific custom plugin package, including user-uploaded Lua or WASM plugin details. Required IAM Permission: Action gateway:GetCustomPlugin, Resource arn:api7:gateway:gatewaysetting/
PUT Update a custom plugin /api/custom_plugins/{custom_plugin_id}Update an existing custom plugin package and its metadata. Changes can affect plugin behavior where the plugin is enabled. Required IAM Permission: Action gateway:UpdateCustomPlugin, Resource arn:api7:gateway:gatewaysetting/
DELETE Delete a custom plugin /api/custom_plugins/{custom_plugin_id}Delete a custom plugin package from the control plane. Ensure the plugin is no longer referenced by services or routes before removal. Required IAM Permission: Action gateway:DeleteCustomPlugin, Resource arn:api7:gateway:gatewaysetting/
PUT Parse custom plugin code /api/custom_plugins/code/parseParse and validate custom plugin source payload to extract plugin metadata and detect structural issues before creating or updating a plugin.
GET List all secret providers on a gateway group /apisix/admin/secret_providersList secret provider integrations configured for the gateway group, such as Vault or cloud secret managers. Use this view to audit external secret backends available for plugin and route configurations. Required IAM Permission: Action gateway:GetSecretProvider, Resource...
GET Get a secret provider on a gateway group /apisix/admin/secret_providers/{secret_provider}/{secret_provider_id}Retrieve details of one secret provider integration in the gateway group, including provider-specific connection settings. Required IAM Permission: Action gateway:GetSecretProvider, Resource arn:api7:gateway:gatewaygroup/%s/secret provider/%s
PUT Update a secret provider on a gateway group /apisix/admin/secret_providers/{secret_provider}/{secret_provider_id}Create or replace the configuration of a secret provider integration in the gateway group. This controls how the gateway resolves externally managed secrets referenced by runtime configs. Required IAM Permission: Action gateway:PutSecretProvider, Resource...
DELETE Delete a secret provider on a gateway group /apisix/admin/secret_providers/{secret_provider}/{secret_provider_id}Delete a secret provider integration from the gateway group. Ensure no plugin or resource still references secrets from this provider before removal. Required IAM Permission: Action gateway:DeleteSecretProvider, Resource arn:api7:gateway:gatewaygroup/%s/secret provider/%s
GET List all protos on a gateway group /apisix/admin/protosList Protocol Buffers definitions stored in the gateway group. These proto files are used by gRPC-transcode related configurations to map REST calls to gRPC methods. Required IAM Permission: Action gateway:GetProto, Resource arn:api7:gateway:gatewaygroup/%s
POST Create a proto on a gateway group /apisix/admin/protosUpload a new .proto definition to the gateway group for gRPC transcoding scenarios. Ensure package and service definitions align with upstream gRPC services. Required IAM Permission: Action gateway:CreateProto, Resource arn:api7:gateway:gatewaygroup/%s
GET Get a proto on a gateway group /apisix/admin/protos/{proto_id}Retrieve one proto definition from the gateway group, including its current content and metadata. Required IAM Permission: Action gateway:GetProto, Resource arn:api7:gateway:gatewaygroup/%s
PUT Update a proto on a gateway group /apisix/admin/protos/{proto_id}Replace an existing proto definition in the gateway group. After updates, verify dependent gRPC-transcode routes still match the revised service and method signatures. Required IAM Permission: Action gateway:UpdateProto, Resource arn:api7:gateway:gatewaygroup/%s
DELETE Delete a proto on a gateway group /apisix/admin/protos/{proto_id}Delete a proto definition from the gateway group. Check for any gRPC-transcode plugin configurations that still reference this proto before deletion. Required IAM Permission: Action gateway:DeleteProto, Resource arn:api7:gateway:gatewaygroup/%s
GET List all service registry connections on a gateway group /api/gateway_groups/{gateway_group_id}/service_registriesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
POST Create a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registriesIAM Action: gateway:ConnectServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}IAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
PUT Update a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}IAM Action: gateway:UpdateServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
DELETE Delete a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}IAM Action: gateway:DisconnectServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all services connected to a service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/connected_servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all internal services in a Kubernetes service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/kubernetes/internal_servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all namespaces in a Nacos service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespacesGET List all groups in a Nacos namespace /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespaces/{nacos_namespace}/groupsIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all internal services in a Nacos group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespaces/{nacos_namespace}/groups/{nacos_group}/servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get all instance metadata of a Nacos services registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/nacos/namespaces/{nacos_namespace}/groups/{nacos_group}/services/{nacos_service}/instances_metadataIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all datacenters in a Consul service registry /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/consul/datacentersIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all services in a Consul datacenter /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/consul/datacenters/{consul_datacenter}/servicesIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get all instance metadata of a Consul service /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/consul/datacenters/{consul_datacenter}/services/{consul_service}/instances_metadataIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get health check history of a service registry connection on a gateway group /api/gateway_groups/{gateway_group_id}/service_registries/{service_registry_id}/health_check_historyIAM Action: gateway:GetServiceRegistry, Resource: arn:api7:gateway:gatewaygroup/%s
GET List all users /api/usersList dashboard user accounts with pagination and role-based filtering. Use this to audit who can authenticate by local credentials or configured SSO methods. Required IAM Permission: Action iam:GetUser, Resource arn:api7:iam:user/%s
GET Get a user /api/users/{user_id}Get one dashboard user account by ID to inspect account details and current state. Required IAM Permission: Action iam:GetUser, Resource arn:api7:iam:user/%s
PUT Update basic attributes of a user /api/users/{user_id}Update basic attributes of a specified dashboard user account. This is intended for administrative account maintenance. Required IAM Permission: Action iam:UpdateUser, Resource arn:api7:iam:user/%s
DELETE Delete a user /api/users/{user_id}Delete a dashboard user account and revoke its login access. Verify downstream ownership and role dependencies before removal. Required IAM Permission: Action iam:DeleteUser, Resource arn:api7:iam:user/%s
PUT Update the user's permission boundaries /api/users/{user_id}/boundariesReplace a user's permission boundaries using permission policy IDs. Boundaries constrain the maximum effective permissions a user can obtain. Required IAM Permission: Action iam:UpdateUserBoundary, Resource arn:api7:iam:user/%s
PUT Reset the password to specific value /api/users/{user_id}/password_resetReset a specified user's password to an administrator-provided value. Use this for recovery or emergency credential rotation. Required IAM Permission: Action iam:ResetPassword, Resource arn:api7:iam:user/%s
PUT Reset (disable) a user's two-factor authentication /api/users/{user_id}/2fa_resetAdministratively disable a specified user's two-factor authentication, for example when the user has lost their authenticator device. Required IAM Permission: Action iam:ResetTwoFactor, Resource arn:api7:iam:user/%s
GET Get my user detail /api/meGet details of the currently authenticated dashboard user.
PUT Update my user profile /api/meUpdate profile attributes of the currently authenticated dashboard user without changing role assignments.
PUT Update the user email /api/me/emailUpdate the email address for the currently authenticated user account.
DELETE Delete the user email /api/me/emailRemove the email address currently bound to the authenticated user account.
POST Start two-factor (2FA) enrollment for the current user /api/me/2fa/setupGenerate a new TOTP secret for the currently authenticated user and return it together with a provisioning URI and QR code. The secret is not active until confirmed via the enable endpoint.
POST Confirm and enable two-factor (2FA) for the current user /api/me/2fa/enableConfirm a pending TOTP secret with a valid code and enable two-factor authentication. Returns one-time recovery codes that are shown only once.
POST Disable two-factor (2FA) for the current user /api/me/2fa/disableDisable two-factor authentication for the currently authenticated user after validating a current TOTP or recovery code.
POST Invite a user /api/invitesInvite a new dashboard user account. The invitation initiates onboarding so the user can later sign in with supported authentication methods. Required IAM Permission: Action iam:InviteUser, Resource arn:api7:iam:user/
PUT Update my user password /api/passwordChange the password for the currently authenticated user account.
POST Log in to API7 Enterprise using the built-in username and password /api/loginAuthenticate a dashboard user with built-in username and password credentials and create a session.
POST Log out from API7 Enterprise using the built-in username and password /api/logoutLog out the current built-in authentication session and invalidate related session state.
PUT Update assigned roles for a user /api/users/{user_id}/assigned_rolesUpdate role assignments for a user. Assigned roles determine the permission policies and effective access granted to that account. Required IAM Permission: Action iam:UpdateUserRole, Resource arn:api7:iam:user/%s
POST Check if a user has permissions on specific resources /api/allow_accessEvaluate whether a user is allowed to perform specified actions on given resources based on current RBAC and policy configuration.
POST Log in to API7 Enterprise using the LDAP username and password /api/ldap/{login_option_id}/loginAuthenticate a user through the specified LDAP login option and create a dashboard session.
POST Log out from API7 Enterprise using the LDAP username and password /api/ldap/{login_option_id}/logoutLog out a session established via LDAP authentication for the specified login option.
GET Log in using the CAS provider /api/cas/{login_option_id}/loginStart or complete CAS login for the selected login option, including CAS ticket processing.
GET Log out using the CAS provider /api/cas/{login_option_id}/logoutStart CAS logout for the selected login option and redirect to the configured post-logout target.
GET Log in using the OIDC provider /api/oidc/{login_option_id}/loginStart OIDC authentication by redirecting to the configured OpenID Connect provider for the selected login option.
GET Log in using the OIDC provider /api/oidc/{login_option_id}/callbackProcess OIDC callback parameters and complete authentication for the selected login option.
GET Log out using the OIDC provider /api/oidc/{login_option_id}/logoutStart OIDC logout flow and redirect through the provider logout endpoint for the selected login option.
GET SAML login (redirect to IdP and call back to Dashboard) /api/saml/{login_option_id}/loginStart SAML 2.0 login by redirecting to the identity provider and preparing for ACS callback handling.
GET SAML Logout (redirect to IdP and call back to Dashboard) /api/saml/{login_option_id}/logoutStart SAML 2.0 logout by redirecting through the identity provider for the selected login option.
POST SAML ACS/SLO callback (from IdP to Dashboard) /api/saml/{login_option_id}/acsHandle SAML ACS/SLO callback payloads posted by the identity provider for the selected login option.
GET SAML ACS/SLO callback (from IdP to Dashboard) /api/saml/{login_option_id}/sloHandle SAML ACS/SLO callback query parameters from the identity provider and finalize SAML sign-in or sign-out.
POST SAML ACS/SLO callback (from IdP to Dashboard) /api/saml/{login_option_id}/sloHandle SAML ACS/SLO callback payloads posted by the identity provider for the selected login option.
GET SAML SP metadata /api/saml/{login_option_id}/metadataGet SAML service provider metadata XML for the specified login option to help configure identity-provider trust.
PUT Update assigned roles for a user /api/users/{user_id}/assigned_rolesUpdate role assignments for a user. Assigned roles determine the permission policies and effective access granted to that account. Required IAM Permission: Action iam:UpdateUserRole, Resource arn:api7:iam:user/%s
GET List all roles /api/rolesList RBAC roles with pagination and filtering. Results include built-in roles (Super Admin, Admin, Viewer) and custom roles. Required IAM Permission: Action iam:GetRole, Resource arn:api7:iam:role/%s
POST Create a role /api/rolesCreate a custom RBAC role used to group permission policies. The new role can then be assigned to users. Required IAM Permission: Action iam:CreateRole, Resource arn:api7:iam:role/
GET Get a role /api/roles/{role_id}Get detailed information for a specific RBAC role. This includes role metadata used to grant permissions through user-role assignments. Required IAM Permission: Action iam:GetRole, Resource arn:api7:iam:role/%s
PUT Update a role /api/roles/{role_id}Update a role definition by ID. Changes affect all users currently assigned to the role. Required IAM Permission: Action iam:UpdateRole, Resource arn:api7:iam:role/%s
DELETE Delete a role /api/roles/{role_id}Delete a custom RBAC role from the organization. Review user assignments first to avoid unintended access loss. Required IAM Permission: Action iam:DeleteRole, Resource arn:api7:iam:role/%s
GET List all permission policies attached to a role /api/roles/{role_id}/permission_policiesList permission policies attached to a role. This reveals the policy statements that determine the role's effective access. Required IAM Permission: Action iam:GetPermissionPolicy, Resource arn:api7:iam:permissionpolicy/%s
POST Attach permission policies to a role /api/roles/{role_id}/attach_permission_policiesAttach permission policies to a role. Attached policies immediately affect all users assigned to that role. Required IAM Permission: Action iam:UpdateRole, Resource arn:api7:iam:role/%s
POST Detach permission policies of a role /api/roles/{role_id}/detach_permission_policiesDetach permission policies from a role. Removing policies may reduce or revoke access for assigned users. Required IAM Permission: Action iam:UpdateRole, Resource arn:api7:iam:role/%s
POST Check if a user has permissions on specific resources /api/allow_accessEvaluate whether a user is allowed to perform specified actions on given resources based on current RBAC and policy configuration.
GET List all permission policies attached to a role /api/roles/{role_id}/permission_policiesList permission policies attached to a role. This reveals the policy statements that determine the role's effective access. Required IAM Permission: Action iam:GetPermissionPolicy, Resource arn:api7:iam:permissionpolicy/%s
POST Attach permission policies to a role /api/roles/{role_id}/attach_permission_policiesAttach permission policies to a role. Attached policies immediately affect all users assigned to that role. Required IAM Permission: Action iam:UpdateRole, Resource arn:api7:iam:role/%s
POST Detach permission policies of a role /api/roles/{role_id}/detach_permission_policiesDetach permission policies from a role. Removing policies may reduce or revoke access for assigned users. Required IAM Permission: Action iam:UpdateRole, Resource arn:api7:iam:role/%s
GET List all permission policies /api/permission_policiesList available permission policies in the organization with pagination and filters. Use this to choose policies for roles and boundaries. Required IAM Permission: Action iam:GetPermissionPolicy, Resource arn:api7:iam:permissionpolicy/%s
POST Create a permission policy /api/permission_policiesCreate a fine-grained permission policy with allow/deny statements over specific IAM actions and resource ARNs. Required IAM Permission: Action iam:CreatePermissionPolicy, Resource arn:api7:iam:permissionpolicy/
GET Get the permission policy authoring catalog /api/permission_policies/metadataReturn the static catalog used by the console Visual Editor to author permission policies: every supported resource type with its ARN templates, available list endpoint, condition keys, and the ordered list of actions classified by access level. The payload is purely...
GET Get a permission policy /api/permission_policies/{permission_policy_id}Get a permission policy by ID, including all statements and metadata. Required IAM Permission: Action iam:GetPermissionPolicy, Resource arn:api7:iam:permissionpolicy/%s
PUT Update a permission policy /api/permission_policies/{permission_policy_id}Update an existing permission policy definition. Changes apply to all roles or users that reference this policy. Required IAM Permission: Action iam:UpdatePermissionPolicy, Resource arn:api7:iam:permissionpolicy/%s
DELETE Delete a permission policy /api/permission_policies/{permission_policy_id}Delete a permission policy. Ensure references are reviewed first to prevent accidental permission breakage. Required IAM Permission: Action iam:DeletePermissionPolicy, Resource arn:api7:iam:permissionpolicy/%s
GET List the Roles or Users that directly reference the Permission Policy /api/permission_policies/{permission_policy_id}/referencesList roles and users that directly reference the specified permission policy. This helps estimate impact before policy changes. Required IAM Permission: Action iam:GetPermissionPolicy, Resource arn:api7:iam:permissionpolicy/%s
GET List all tokens /api/tokensList API access tokens created for programmatic dashboard API access, with pagination, ordering, and search filters.
POST Create a token /api/tokensCreate a new API access token for programmatic, non-interactive access to dashboard APIs. You can configure token metadata and optional expiration at creation time.
GET Get a token /api/tokens/{token_id}Get details of an API access token by token ID.
PUT Update a token /api/tokens/{token_id}Update mutable properties of an API access token, such as expiration and metadata fields.
DELETE Delete a token /api/tokens/{token_id}Delete an API access token and immediately revoke its ability to authenticate API requests.
PUT Regenerate a token /api/tokens/{token_id}/regenerateRegenerate the secret value of an existing API access token. Clients must replace stored credentials after regeneration.
GET Get a login option /api/login_options/{login_option_id}Get a login option configuration by ID. This returns settings for one external authentication integration such as OIDC, LDAP, SAML 2.0, or CAS. Required IAM Permission: Action iam:GetLoginOption, Resource arn:api7:iam:organization/
PUT Update a login option /api/login_options/{login_option_id}Fully update a login option configuration with a complete protocol-specific payload. Required IAM Permission: Action iam:UpdateLoginOption, Resource arn:api7:iam:organization/
DELETE Delete a login option /api/login_options/{login_option_id}Delete a login option and remove that authentication method from available sign-in choices. Required IAM Permission: Action iam:DeleteLoginOption, Resource arn:api7:iam:organization/
PATCH Patch a login option /api/login_options/{login_option_id}Partially update a login option using JSON Patch (RFC 6902). Use this for targeted changes without replacing full configuration. Required IAM Permission: Action iam:UpdateLoginOption, Resource arn:api7:iam:organization/
GET List all login options /api/login_optionsList all configured login options for the organization, including protocol-specific provider settings. Required IAM Permission: Action iam:GetLoginOption, Resource arn:api7:iam:organization/
POST Create a login option /api/login_optionsCreate a new login option for external authentication integration. Supported protocols include OIDC, LDAP, SAML 2.0, and CAS. Required IAM Permission: Action iam:CreateLoginOption, Resource arn:api7:iam:organization/
GET List all login options (public) /api/login_options_for_loginList login options. No authentication is required, and provider or policy/role details are not included in the response.
GET Get API7 Enterprise license details /api/licenseRetrieve current API7 Enterprise license information, including validity and licensed capabilities. Use this endpoint to inspect license status for operations and troubleshooting.
PUT Import or update the API7 Enterprise license /api/licenseImport a new license payload or update the existing enterprise license for the organization. You can optionally use dry-run mode to validate license content before applying it. Required IAM Permission: Action iam:UpdateLicense, Resource arn:api7:iam:organization/
GET Get all labels of a resource type /api/labels/{resource_type}List available key-value labels for the specified resource type. Use these labels to organize resources and apply label-based filtering in list queries.
GET List all alert policies /api/alert/policiesList alert policies configured for monitoring conditions such as error rates, latency thresholds, and availability checks. Use query filters to narrow results by severity, status, labels, and search terms. Required IAM Permission: Action gateway:GetAlertPolicy, Resource...
POST Create an alert policy /api/alert/policiesCreate a new alert policy that defines trigger conditions, evaluation behavior, and notification routing. After creation, the policy can begin generating alert history entries when conditions are met. Required IAM Permission: Action gateway:CreateAlertPolicy, Resource...
GET Get an alert policy /api/alert/policies/{alert_policy_id}Retrieve the full configuration of a specific alert policy, including its trigger rules and notification settings. Use this endpoint before updating or troubleshooting policy behavior. Required IAM Permission: Action gateway:GetAlertPolicy, Resource arn:api7:gateway:alert/%s
PUT Update an alert policy /api/alert/policies/{alert_policy_id}Replace the full configuration of an alert policy with the provided payload. Use this operation when you want to update all policy fields in a single request. Required IAM Permission: Action gateway:UpdateAlertPolicy, Resource arn:api7:gateway:alert/%s
DELETE Delete an alert policy /api/alert/policies/{alert_policy_id}Delete an existing alert policy so it no longer evaluates conditions or sends notifications. This action affects future alerting only and does not remove historical alert records. Required IAM Permission: Action gateway:DeleteAlertPolicy, Resource arn:api7:gateway:alert/%s
PATCH Patch an alert policy /api/alert/policies/{alert_policy_id}Partially update an alert policy using JSON Patch (RFC 6902) operations. This is useful for targeted edits without resubmitting the full policy definition. Required IAM Permission: Action gateway:UpdateAlertPolicy, Resource arn:api7:gateway:alert/%s
GET List all alert histories /api/alert/policies/historiesList historical alert events triggered by alert policies, including occurrence time, severity, and related gateway group context. Use time-range and policy filters to investigate incidents and alert trends. Required IAM Permission: Action gateway:GetAlertPolicy, Resource...
GET List Contact Points /api/contact_pointsList contact points available for alert notification delivery. Use filters and pagination to locate channels by type, labels, or search terms. Required IAM Permission: Action iam:GetContactPoint, Resource arn:api7:iam:contactpoint/%s
POST Create a contact point /api/contact_pointsCreate a new contact point to deliver alert notifications through channels such as email, webhook, Slack, or DingTalk. The created contact point can then be referenced by alert policies. Required IAM Permission: Action iam:CreateContactPoint, Resource arn:api7:iam:contactpoint/
GET Get a contact point /api/contact_points/{contact_point_id}Retrieve details of a specific contact point, including its configuration and metadata. Use this before updating or validating notification settings. Required IAM Permission: Action iam:GetContactPoint, Resource arn:api7:iam:contactpoint/%s
PUT Update a contact point /api/contact_points/{contact_point_id}Update a contact point configuration, such as destination address, authentication details, or labels. Changes take effect for subsequent alert notifications. Required IAM Permission: Action iam:UpdateContactPoint, Resource arn:api7:iam:contactpoint/%s
DELETE Delete a contact point /api/contact_points/{contact_point_id}Delete a contact point so it can no longer be used as an alert notification channel. Ensure dependent alert policies are updated to avoid delivery failures. Required IAM Permission: Action iam:DeleteContactPoint, Resource arn:api7:iam:contactpoint/%s
GET List notification logs of a contact point /api/contact_points/{contact_point_id}/notification_logsList notification delivery logs for a contact point, including status, target resource type, and timestamps. Use this to troubleshoot failed or delayed alert notifications. Required IAM Permission: Action iam:GetContactPoint, Resource arn:api7:iam:contactpoint/%s
GET List a contact point usages /api/contact_points/{contact_point_id}/usagesList resources that currently reference the specified contact point. Check usage before deletion or major edits to understand downstream impact. Required IAM Permission: Action iam:GetContactPoint, Resource arn:api7:iam:contactpoint/%s
GET List all audit logs /api/audit_logsRetrieve immutable audit log records for administrative and configuration actions, including who performed each action and when. Use filters such as event type, operator, resource, gateway group, and time range to narrow the result set. Required IAM Permission: Action...
GET List all event types of audit logs /api/audit_logs/event_typesList supported audit event types that can be used for filtering and analysis when querying audit logs. No IAM permission required.
GET Export all audit logs /api/audit_logs/exportExport audit logs that match the specified filters into a downloadable file format for compliance, archival, or external analysis. Apply event, operator, resource, and time-range filters before export to control data scope. Required IAM Permission: Action iam:ExportAudits...
GET Get the configuration for audit logs. /api/audit_logs/configGet the current audit logging configuration for the organization. Use this to verify how audit events are captured and retained. No IAM permission required.
GET Get provider portal monitoring data at a single point in time /api/portal/monitor/querySee Prometheus instant queries for more information.
GET Get provider portal monitoring data over a range of time /api/portal/monitor/query_rangeSee Prometheus range queries for more information.
GET Get data from Prometheus /api/control_plane/prometheus/{prometheus_path}POST Get data from Prometheus /api/control_plane/prometheus/{prometheus_path}GET List debug sessions /api/gateway_groups/{gateway_group_id}/debug_sessionsIAM Action: gateway:GetDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
POST Create a debug session /api/gateway_groups/{gateway_group_id}/debug_sessionsIAM Action: gateway:CreateDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get a debug session /api/gateway_groups/{gateway_group_id}/debug_sessions/{debug_session_id}IAM Action: gateway:GetDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
DELETE Delete a debug session /api/gateway_groups/{gateway_group_id}/debug_sessions/{debug_session_id}IAM Action: gateway:DeleteDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
POST Stop a debug session /api/gateway_groups/{gateway_group_id}/debug_sessions/{debug_session_id}/stopIAM Action: gateway:StopDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
GET List traces of a debug session /api/gateway_groups/{gateway_group_id}/debug_sessions/{debug_session_id}/tracesIAM Action: GetDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get a trace detail /api/gateway_groups/{gateway_group_id}/debug_sessions/{debug_session_id}/traces/{trace_id}IAM Action: GetDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
POST Download a trace /api/gateway_groups/{gateway_group_id}/debug_sessions/{debug_session_id}/traces/{trace_id}/downloadIAM Action: gateway:ExportDebugSession, Resource: arn:api7:gateway:gatewaygroup/%s
GET Get schema by resource name /apisix/admin/schema/{resource_name}Get the schema definition for a specific resource type by name. This is useful when rendering dynamic forms or validating resource-specific request payloads.
GET Get schema definition of a plugin /apisix/admin/schema/plugins/{plugin_name}Get schema definition of a plugin, including plugin meta properties and plugin properties.
GET Get OpenAPI schema /api/openapi/request_body_schemaThe endpoint returns the request body schema of PUT/POST requests for users to understand how to structure a request.
GET Get core resources schema /api/schema/coreRetrieve schema definitions for core gateway resources. Use these schemas to validate payload structures and build configuration tooling.
GET Get all variables /apisix/admin/variablesList all APISIX variables (including built-in NGINX variables) that can be used in route matching conditions and plugin configurations.
GET Get deployment settings /api/system_settingsRetrieve current global deployment settings for the control plane. Use this endpoint to inspect active system-level configuration before making changes.
PUT Update deployment settings /api/system_settingsUpdate global system settings that control dashboard deployment behavior and platform-wide defaults. This operation affects configuration used across managed gateway resources. Required IAM Permission: Action gateway:UpdateDeploymentSetting, Resource...
GET Get SCIM settings /api/system_settings/scimRetrieve the current SCIM provisioning configuration for the organization. Use this to validate synchronization endpoints and provisioning status. Required IAM Permission: Action iam:GetSCIMProvisioning, Resource arn:api7:iam:organization/
PUT Update SCIM settings /api/system_settings/scimUpdate SCIM provisioning settings used for automated identity and user lifecycle synchronization. Changes here affect how external identity providers integrate with organization users. Required IAM Permission: Action iam:UpdateSCIMProvisioning, Resource arn:api7:iam:organization/
PUT Generate SCIM Token /api/system_settings/scim/tokenGenerate or rotate the SCIM access token used by external identity providers to call SCIM provisioning APIs. Rotating this token may require updating the provider configuration. Required IAM Permission: Action iam:UpdateSCIMProvisioning, Resource arn:api7:iam:organization/
GET Get SMTP server settings /api/system_settings/smtp_serverRetrieve the current SMTP server settings configured for outbound email delivery. Use this endpoint when auditing email configuration or debugging mail issues. Required IAM Permission: Action iam:GetSMTPServer, Resource arn:api7:iam:organization/
PUT Update SMTP server settings /api/system_settings/smtp_serverUpdate SMTP server configuration used for system email delivery, including notifications and verification emails. Ensure credentials and host settings are valid to avoid delivery failures. Required IAM Permission: Action iam:UpdateSMTPServer, Resource arn:api7:iam:organization/
GET Get SMTP server settings status /api/system_settings/smtp_server_statusGet the health and readiness status of the configured SMTP server settings. This endpoint helps verify whether current configuration can be used for email sending.
GET Get login failure restriction settings /api/system_settings/login_failure_restrictionRetrieve the current policy for temporarily banning built-in users after too many consecutive failed login attempts. Required IAM Permission: Action iam:GetLoginFailureRestriction, Resource arn:api7:iam:organization/
PUT Update login failure restriction settings /api/system_settings/login_failure_restrictionUpdate the policy that temporarily bans built-in users after too many consecutive failed login attempts, including the failure threshold and ban duration. Required IAM Permission: Action iam:UpdateLoginFailureRestriction, Resource arn:api7:iam:organization/
GET Get developer portal public access /api/portal/system_settings/public_accessGet the current developer portal public access configuration for the specified portal. Use this to verify login and public accessibility settings. Required IAM Permission: Action portal:GetDeveloperPortalPublicAccess, Resource arn:api7:portal:portal/%s/loginsetting/
PUT Update developer portal public access /api/portal/system_settings/public_accessUpdate public access and login behavior for a developer portal, such as how external users can access sign-in or registration flows. This setting controls portal exposure and authentication entry points. Required IAM Permission: Action portal:UpdateDeveloperPortalPublicAccess...
GET Get all system infos /api/system_infosRetrieve system metadata for the dashboard environment, such as version details, license state, and runtime information used for administration and diagnostics.
GET Check if an email is verified /api/email_verifiedCheck whether the specified email address has completed verification. Use this to gate workflows that require verified contact information.
GET Get email verification /api/verify_emailVerify an email address using the verification token and redirect to the corresponding result page. This endpoint is typically called from links sent in verification emails.
GET Get Dashboard Version /api/versionReturn the current dashboard version information. Use this endpoint for compatibility checks and operational diagnostics.
POST Get resource names /api/resource_namesQuery resource names by conditions in the request payload to support selectors, autocomplete, or dependency checks in UI workflows.
GET List all DCR providers /api/dcr_providersIAM Action: portal:GetDCRProvider, Resource: arn:api7:portal:dcrprovider/%s
POST Create an DCR provider /api/dcr_providersIAM Action: portal:CreateDCRProvider, Resource: arn:api7:portal:dcrprovider/
GET Get an DCR provider /api/dcr_providers/{dcr_provider_id}IAM Action: portal:GetDCRProvider, Resource: arn:api7:portal:dcrprovider/%s
PUT Update an DCR Provider /api/dcr_providers/{dcr_provider_id}IAM Action: portal:UpdateDCRProvider, Resource: arn:api7:portal:dcrprovider/%s
DELETE Delete an DCR Provider /api/dcr_providers/{dcr_provider_id}IAM Action: portal:DeleteDCRProvider, Resource: arn:api7:portal:dcrprovider/%s
GET List all API products in Provider Portal /api/api_productsIAM Action: portal:GetAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
POST Create an API product in Provider Portal /api/api_productsIAM Action: portal:CreateAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/
GET Get an API product in Provider Portal /api/api_products/{api_product_id}IAM Action: portal:GetAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
PUT Update an API product in Provider Portal /api/api_products/{api_product_id}IAM Action: portal:UpdateAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
DELETE Delete an API product in Provider Portal /api/api_products/{api_product_id}IAM Action: portal:DeleteAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
PATCH Patch an API product in Provider Portal /api/api_products/{api_product_id}IAM Action: portal:UpdateAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
GET List all subscriptions in Provider Portal for an API product /api/api_products/{api_product_id}/subscriptionsIAM Action: portal:GetAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
DELETE Cancel a subscription in Provider Portal for an API product /api/api_products/{api_product_id}/subscriptions/{subscription_id}IAM Action: portal:UpdateAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
GET List all notification histories for an API product /api/api_products/{api_product_id}/notification_historiesIAM Action: portal:GetAPIProduct, Resource: arn:api7:portal:portal/%s/apiproduct/%s
GET List all portal instances /api/portalsIAM Action: portal:ListPortals, Resource: arn:api7:portal:portal/
POST Create a portal instance /api/portalsIAM Action: portal:CreatePortal, Resource: arn:api7:portal:portal/
GET Get a portal instance /api/portals/{portal_id}IAM Action: portal:GetPortal, Resource: arn:api7:portal:portal/%s
PUT Update a portal instance /api/portals/{portal_id}IAM Action: portal:UpdatePortal, Resource: arn:api7:portal:portal/%s
DELETE Delete a portal instance /api/portals/{portal_id}IAM Action: portal:DeletePortal, Resource: arn:api7:portal:portal/%s
GET List all portal tokens /api/portal/tokensIAM Action: portal:GetPortalToken, Resource: arn:api7:portal:portal/%s/token/
POST Create a portal token /api/portal/tokensIAM Action: portal:CreatePortalToken, Resource: arn:api7:portal:portal/%s/token/
GET Get a portal token /api/portal/tokens/{portal_token_id}IAM Action: portal:GetPortalToken, Resource: arn:api7:portal:portal/%s/token/
PUT Update a portal token /api/portal/tokens/{portal_token_id}IAM Action: portal:UpdatePortalToken, Resource: arn:api7:portal:portal/%s/token/
DELETE Delete a portal token /api/portal/tokens/{portal_token_id}IAM Action: portal:DeletePortalToken, Resource: arn:api7:portal:portal/%s/token/
PUT Regenerate a portal token /api/portal/tokens/{portal_token_id}/regenerateIAM Action: portal:UpdatePortalToken, Resource: arn:api7:portal:portal/%s/token/
GET List Developers /api/developersIAM Action: portal:GetDeveloper, Resource: arn:api7:portal:portal/%s/developer/%s
DELETE Delete a developer /api/developers/{developer_external_id}IAM Action: portal:DeleteDeveloper, Resource: arn:api7:portal:portal/%s/developer/%s
GET List approvals /api/approvalsList pending and processed approval workflow items for developer portal operations, such as API product subscriptions and developer registrations. Use filters to review approvals by status, event type, operator, applicant, and resource. Required IAM Permission: For event type...
POST Accept an approval request /api/approvals/{approval_id}/acceptApprove a specific workflow request and apply the corresponding portal-side change, such as granting an API product subscription or accepting a developer sign-up. This operation advances the approval lifecycle to an accepted state. Required IAM Permission: For event type api...
POST Reject an approval request /api/approvals/{approval_id}/rejectReject a specific workflow approval request so the requested action is not applied. Use this endpoint to explicitly deny subscription or registration requests that do not meet review criteria. Required IAM Permission: For event type api product subscription: Action...
GET List all AI Gateway groups /api/ai_gateway_groupsReturns a paginated list of all AI Gateway groups (AISIX clusters).
POST Create an AI Gateway group /api/ai_gateway_groupsIAM Action: ai gateway:CreateAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/ Creates a new AI Gateway group (AISIX cluster).
GET Get an AI Gateway group /api/ai_gateway_groups/{ai_gateway_group_id}IAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns the specified AI Gateway group by ID.
PUT Update an AI Gateway group /api/ai_gateway_groups/{ai_gateway_group_id}IAM Action: ai gateway:UpdateAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Updates the name, description, or configuration of the specified AI Gateway group.
DELETE Delete an AI Gateway group /api/ai_gateway_groups/{ai_gateway_group_id}IAM Action: ai gateway:DeleteAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Deletes the specified AI Gateway group and all its associated instances.
GET List AI Gateway instances in a group /api/ai_gateway_groups/{ai_gateway_group_id}/instancesIAM Action: ai gateway:GetAIGatewayInstance, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns all AI Gateway instances (AISIX nodes) registered in the specified group. Instance status is computed dynamically from the last heartbeat time: Healthy within 60 seconds...
DELETE Delete a single AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/instances/{ai_gateway_instance_id}IAM Action: ai gateway:DeleteAIGatewayInstance, Resource: arn:api7:ai gateway:aigatewaygroup/%s Removes the specified AI Gateway instance from its group.
GET Generate a Docker run command to install an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/dockerIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a docker run command that configures and starts an AISIX AI Gateway instance connected to the specified AI Gateway group.
GET Generate a Docker Compose file to install an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/docker-composeIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a Docker Compose configuration that starts an AISIX AI Gateway instance connected to the specified AI Gateway group.
GET Generate a Helm install script for an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/helm/scriptIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a shell script that uses Helm to install an AISIX AI Gateway instance in Kubernetes, connected to the specified AI Gateway group.
GET Generate a Helm values YAML for an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/helm/yamlIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a Helm values YAML file for deploying an AISIX AI Gateway instance in Kubernetes, connected to the specified AI Gateway group.
POST Issue an AI data plane certificate /api/ai_gateway_groups/{ai_gateway_group_id}/dp_client_certificatesIssues a client mTLS certificate for an aisix-ee AI Gateway instance to authenticate with the control plane (dp-manager). Use this during aisix-ee bootstrap or certificate rotation.
GET List AI Gateway instances in a group /api/ai_gateway_groups/{ai_gateway_group_id}/instancesIAM Action: ai gateway:GetAIGatewayInstance, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns all AI Gateway instances (AISIX nodes) registered in the specified group. Instance status is computed dynamically from the last heartbeat time: Healthy within 60 seconds...
DELETE Delete a single AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/instances/{ai_gateway_instance_id}IAM Action: ai gateway:DeleteAIGatewayInstance, Resource: arn:api7:ai gateway:aigatewaygroup/%s Removes the specified AI Gateway instance from its group.
GET Generate a Docker run command to install an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/dockerIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a docker run command that configures and starts an AISIX AI Gateway instance connected to the specified AI Gateway group.
GET Generate a Docker Compose file to install an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/docker-composeIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a Docker Compose configuration that starts an AISIX AI Gateway instance connected to the specified AI Gateway group.
GET Generate a Helm install script for an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/helm/scriptIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a shell script that uses Helm to install an AISIX AI Gateway instance in Kubernetes, connected to the specified AI Gateway group.
GET Generate a Helm values YAML for an AI Gateway instance /api/ai_gateway_groups/{ai_gateway_group_id}/deployment/helm/yamlIAM Action: ai gateway:GetAIGatewayGroup, Resource: arn:api7:ai gateway:aigatewaygroup/%s Generates a Helm values YAML file for deploying an AISIX AI Gateway instance in Kubernetes, connected to the specified AI Gateway group.
POST Issue an AI data plane certificate /api/ai_gateway_groups/{ai_gateway_group_id}/dp_client_certificatesIssues a client mTLS certificate for an aisix-ee AI Gateway instance to authenticate with the control plane (dp-manager). Use this during aisix-ee bootstrap or certificate rotation.
POST Validate batch configuration /apisix/admin/configs/validateValidate a batch of APISIX declarative configurations including routes, services, consumers, upstreams, etc. Performs resource-level JSON Schema validation, plugin check schema advanced validation, and duplicate ID detection. Returns all validation errors at once.
POST Upload a file /api/filesUpload a file to the control plane. The file is stored compressed in the database. Returns the file ID which can be used to construct a dp-manager URL for plugin configuration.
GET Download file content /api/files/{file_id}Download the original content of an uploaded file.
GET List model catalog entries /api/model_catalogsIAM Action: ai gateway:ListModelCatalogs, Resource: arn:api7:ai gateway:modelcatalog/ Returns globally synchronized model catalog entries that can be used to populate AI model selections. Set compact=true to receive the reduced dropdown-oriented item shape.
POST Trigger a manual model catalog sync /api/model_catalogs/syncIAM Action: ai gateway:SyncModelCatalog, Resource: arn:api7:ai gateway:modelcatalog/ Triggers an immediate synchronization against the configured upstream model catalog endpoint. Remote fetch failures are returned as HTTP 200 with success=false; HTTP 409 is reserved for...
GET List model catalog sync logs /api/model_sync_logsIAM Action: ai gateway:ListModelSyncLogs, Resource: arn:api7:ai gateway:modelcatalog/ Returns synchronization history entries, including execution status and structured diff information.
GET List AI models in a group /aisix/admin/modelsIAM Action: ai gateway:ListAIModels, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns all AI model configurations in the specified AI Gateway group.
POST Create an AI model /aisix/admin/modelsIAM Action: ai gateway:CreateAIModel, Resource: arn:api7:ai gateway:aigatewaygroup/%s Creates a new AI model configuration in the specified AI Gateway group. The model will be synced to the aisix data plane via etcd.
GET Get an AI model /aisix/admin/models/{model_id}IAM Action: ai gateway:GetAIModel, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns the specified AI model configuration by ID.
PUT Update an AI model /aisix/admin/models/{model_id}IAM Action: ai gateway:UpdateAIModel, Resource: arn:api7:ai gateway:aigatewaygroup/%s Updates the specified AI model configuration. Changes are synced to the aisix data plane via etcd.
DELETE Delete an AI model /aisix/admin/models/{model_id}IAM Action: ai gateway:DeleteAIModel, Resource: arn:api7:ai gateway:aigatewaygroup/%s Deletes the specified AI model configuration and removes it from etcd.
GET List AI API keys in a group /aisix/admin/apikeysIAM Action: ai gateway:ListAIAPIKeys, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns all AI API key configurations in the specified AI Gateway group.
POST Create an AI API key /aisix/admin/apikeysIAM Action: ai gateway:CreateAIAPIKey, Resource: arn:api7:ai gateway:aigatewaygroup/%s Creates a new AI API key in the specified AI Gateway group. The key will be synced to the aisix data plane via etcd.
GET Get an AI API key /aisix/admin/apikeys/{api_key_id}IAM Action: ai gateway:GetAIAPIKey, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns the specified AI API key configuration by ID.
PUT Update an AI API key /aisix/admin/apikeys/{api_key_id}IAM Action: ai gateway:UpdateAIAPIKey, Resource: arn:api7:ai gateway:aigatewaygroup/%s Updates the specified AI API key configuration. Changes are synced to the aisix data plane via etcd.
DELETE Delete an AI API key /aisix/admin/apikeys/{api_key_id}IAM Action: ai gateway:DeleteAIAPIKey, Resource: arn:api7:ai gateway:aigatewaygroup/%s Deletes the specified AI API key configuration and removes it from etcd.
GET List AI providers in a group /aisix/admin/providersIAM Action: ai gateway:ListAIProviders, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns all AI provider configurations in the specified AI Gateway group.
POST Create an AI provider /aisix/admin/providersIAM Action: ai gateway:CreateAIProvider, Resource: arn:api7:ai gateway:aigatewaygroup/%s Creates a new AI provider configuration in the specified AI Gateway group. The provider will be synced to the aisix data plane via etcd.
GET Get an AI provider /aisix/admin/providers/{provider_id}IAM Action: ai gateway:GetAIProvider, Resource: arn:api7:ai gateway:aigatewaygroup/%s Returns the specified AI provider configuration by ID.
PUT Update an AI provider /aisix/admin/providers/{provider_id}IAM Action: ai gateway:UpdateAIProvider, Resource: arn:api7:ai gateway:aigatewaygroup/%s Updates the specified AI provider configuration. Changes are synced to the aisix data plane via etcd.
DELETE Delete an AI provider /aisix/admin/providers/{provider_id}IAM Action: ai gateway:DeleteAIProvider, Resource: arn:api7:ai gateway:aigatewaygroup/%s Deletes the specified AI provider configuration and removes it from etcd. Returns 409 Conflict if any AI models reference this provider.
GET List AI gateway span logs /api/ai_gateway_logsIAM Action: ai gateway:ListAIGatewayLogs, Resource: arn:api7:ai gateway:aigatewaygroup/ Returns a paginated list of AI/LLM span logs extracted from OTLP traces sent by AI gateway dataplanes.