节点、服务与网关

读取节点、服务和网关运行信息,并维护允许编辑的服务元数据。 本页完整列出 7 个受支持操作的请求与响应契约。

路径均相对于 https://<nsd-host>。先设置 NSD_BASE_URL=https://<nsd-host>/api/v1 和 NSD_TOKEN;示例 ID 与数据均为虚构值。

列出节点

GET/api/v1/nodesread-only / full

参数

名称位置类型必填说明
kindquerystring | null否Filter by machine kind (NSN, NSC, NSGW).
cursorquerystring | null否Pagination cursor. Use next_cursor from the previous response unchanged.
limitqueryinteger | null否Cursor pagination: requested page size.

请求示例

curl --silent --show-error --fail-with-body -X GET \
  "$NSD_BASE_URL/nodes?limit=100" \
  -H "Authorization: Bearer $NSD_TOKEN" \
  -H 'Accept: application/json'

响应状态

状态含义响应结构
200Paginated Node inventoryListNodesResponse
401缺少或无效的 Bearer 令牌。ProblemDetails

200 响应

字段类型必有说明
itemsarray<NodeInventoryView>是Nodes in this page.
items[].archstring | null否CPU architecture reported by the associated Device.
items[].client_versionstring | null否NS client version reported by the associated Device.
items[].device_idstring是Stable Device identity associated with this Node.
items[].device_namestring是Label of the associated Device.
items[].hostnamestring | null否Hostname reported by the associated Device.
items[].idstring是NSD record id used by management actions.
items[].last_seenstring | null否Latest observation time in RFC 3339 UTC, or null when never observed.
items[].namestring是Operator-facing Node label, or Node identity when unnamed.
items[].node_domainstring是Legacy Node DNS name in the configured node namespace.
items[].node_idstring是Stable Node identity.
items[].node_ipstring | null否Stable overlay address in this Network.
items[].osstring | null否Runtime metadata useful for fleet diagnosis.
items[].os_versionstring | null否Operating-system version reported by the associated Device.
items[].policy_versioninteger | null否Last policy version acknowledged by the Node.
items[].posture_availableboolean是Whether the posture authority was readable for this response.
items[].principal_kindstring是user or organization.
items[].principal_user_idstring | null否Human principal or null for an Organization-owned workload.
items[].runtime_statestring是connected, offline, or waiting_first_connection.
items[].short_dns_canonical_namestring | null否Short DNS v2 canonical Node FQDN, when compact authority is available.
next_cursorstring | null否Cursor for the next page, or null when there is no next page.
{
  "items": [
    {
      "arch": "example",
      "client_version": "v1",
      "device_id": "dev_01K4DEVICE00000000000000",
      "device_name": "example",
      "hostname": "example",
      "id": "01K4EXAMPLE0000000000000",
      "last_seen": "example",
      "name": "示例资源",
      "node_domain": "web.example-network.svc.ns.io",
      "node_id": "01K4EXAMPLE0000000000000",
      "node_ip": "100.64.0.12",
      "os": "example",
      "os_version": "v1",
      "policy_version": 1,
      "posture_available": false,
      "principal_kind": "example",
      "principal_user_id": "01K4USER000000000000000000",
      "runtime_state": "connected",
      "short_dns_canonical_name": "example"
    }
  ],
  "next_cursor": "example"
}

错误响应均使用 Problem Details;调用方应判断 HTTP 状态和稳定的 code,不要解析 detail 文案。

列出服务

GET/api/v1/servicesread-only / full

参数

名称位置类型必填说明
cursorquerystring | null否Opaque cursor — the last id of the previous page. Absent on page 1.
limitqueryinteger | null否Requested page size; clamped to 1..=MAX_LIMIT.

请求示例

curl --silent --show-error --fail-with-body -X GET \
  "$NSD_BASE_URL/services?limit=100" \
  -H "Authorization: Bearer $NSD_TOKEN" \
  -H 'Accept: application/json'

响应状态

状态含义响应结构
200Paginated list of services in the caller's realmListServicesResponse
401缺少或无效的 Bearer 令牌。ProblemDetails

200 响应

字段类型必有说明
itemsarray<ServiceView>是Services in this page.
items[].backend_hintstring是Backend host:port hint.
items[].backend_public_edge_readyboolean | null否Whether the backend node can serve as a public-ingress backend.
items[].custom_domainstring | null否Operator-declared custom domain (Service.domain in the node's services.toml), absent when the service declares none. For an HTTP/HTTPS service this is the only host the origin answers on: it selects its virtual host by Host/SNI and holds a certificate for this name alone, so the FQID lands on the default virtual host instead. Consumers presenting an access address must prefer this and fall back to the FQID; the FQID remains the service's identity.
items[].domainstring是Service domain: the declared custom domain, or a generated fallback. Read custom_domain to distinguish a declared name.
items[].gateway_bindingGatewayBindingView否—
items[].gateway_binding.auto_boundboolean是Whether this binding is derived from the site's default gateway.
items[].gateway_binding.gateway_idstring是Gateway ULID.
items[].gateway_binding.idstring是Binding identifier.
items[].gateway_binding.modestring是Transport mode.
items[].gateway_binding.priorityinteger是Binding priority.
items[].gateway_binding.service_idstring是Service ULID.
items[].idstring是Service ULID.
items[].last_sync_atstring是Last sync time (RFC 3339 UTC).
items[].listen_hintstring | null否Optional listen hint.
items[].namestring是Service name.
items[].protocolstring是Protocol (tcp, udp, or http).
items[].public_edgeServicePublicEdgeView是Public ingress overlay.
items[].public_edge.exposedboolean是Whether the service is exposed on the public edge.
items[].public_edge.public_hoststring | null否Public host, or null when not exposed.
items[].public_edge.routing_gateway_idstring | null否Gateway used for public routing, when pinned.
items[].public_edge.subject_policyobject | null否Subject policy selected for the exposure.
items[].public_virtual_portinteger | null否Public-edge L4 listener port, when configured.
items[].reported_bystring是Reporting machine id.
items[].short_dns_canonical_namestring | null否Short DNS v2 canonical Service FQDN, when compact authority is available.
items[].site_idstring | null否Site ULID, or null when the reporting machine has no site.
items[].source_ipSourceIpAdmissionView否—
items[].source_ip.allow_cidrsarray<string>是Allowed CIDR ranges.
items[].source_ip.deny_cidrsarray<string>是Denied CIDR ranges.
items[].source_ip.fail_closedboolean是Whether the route fails closed when the filter cannot be evaluated.
items[].statusstring是Service status (active or offline).
items[].vipstring是Backend VIP/host.
items[].virtual_portinteger | null否Overlay virtual port used for ACL authoring.
next_cursorstring | null否Cursor for the next page, or null when there is no next page.
{
  "items": [
    {
      "backend_hint": "example",
      "backend_public_edge_ready": false,
      "custom_domain": "web.example-network.svc.ns.io",
      "domain": "web.example-network.svc.ns.io",
      "gateway_binding": {},
      "id": "01K4EXAMPLE0000000000000",
      "last_sync_at": "2026-09-09T10:00:00Z",
      "listen_hint": "example",
      "name": "示例资源",
      "protocol": "tcp",
      "public_edge": {},
      "public_virtual_port": 1,
      "reported_by": "n-01K4NODE000000000000000",
      "short_dns_canonical_name": "example",
      "site_id": "01K4EXAMPLE0000000000000",
      "source_ip": {},
      "status": "active",
      "vip": "100.64.0.12",
      "virtual_port": 1
    }
  ],
  "next_cursor": "example"
}

错误响应均使用 Problem Details;调用方应判断 HTTP 状态和稳定的 code,不要解析 detail 文案。

读取服务

GET/api/v1/services/{id}read-only / full

参数

名称位置类型必填说明
idpathstring是Service ULID

请求示例

curl --silent --show-error --fail-with-body -X GET \
  "$NSD_BASE_URL/services/${SERVICE_ID}" \
  -H "Authorization: Bearer $NSD_TOKEN" \
  -H 'Accept: application/json'

响应状态

状态含义响应结构
200The service with public-edge and source-IP overlaysServiceView
401缺少或无效的 Bearer 令牌。ProblemDetails
404当前 Network 中不存在该服务。ProblemDetails

200 响应

字段类型必有说明
backend_hintstring是Backend host:port hint.
backend_public_edge_readyboolean | null否Whether the backend node can serve as a public-ingress backend.
custom_domainstring | null否Operator-declared custom domain (Service.domain in the node's services.toml), absent when the service declares none. For an HTTP/HTTPS service this is the only host the origin answers on: it selects its virtual host by Host/SNI and holds a certificate for this name alone, so the FQID lands on the default virtual host instead. Consumers presenting an access address must prefer this and fall back to the FQID; the FQID remains the service's identity.
domainstring是Service domain: the declared custom domain, or a generated fallback. Read custom_domain to distinguish a declared name.
gateway_bindingGatewayBindingView否—
gateway_binding.auto_boundboolean是Whether this binding is derived from the site's default gateway.
gateway_binding.gateway_idstring是Gateway ULID.
gateway_binding.idstring是Binding identifier.
gateway_binding.modestring是Transport mode.
gateway_binding.priorityinteger是Binding priority.
gateway_binding.service_idstring是Service ULID.
idstring是Service ULID.
last_sync_atstring是Last sync time (RFC 3339 UTC).
listen_hintstring | null否Optional listen hint.
namestring是Service name.
protocolstring是Protocol (tcp, udp, or http).
public_edgeServicePublicEdgeView是Public ingress overlay.
public_edge.exposedboolean是Whether the service is exposed on the public edge.
public_edge.public_hoststring | null否Public host, or null when not exposed.
public_edge.routing_gateway_idstring | null否Gateway used for public routing, when pinned.
public_edge.subject_policyobject | null否Subject policy selected for the exposure.
public_virtual_portinteger | null否Public-edge L4 listener port, when configured.
reported_bystring是Reporting machine id.
short_dns_canonical_namestring | null否Short DNS v2 canonical Service FQDN, when compact authority is available.
site_idstring | null否Site ULID, or null when the reporting machine has no site.
source_ipSourceIpAdmissionView否—
source_ip.allow_cidrsarray<string>是Allowed CIDR ranges.
source_ip.deny_cidrsarray<string>是Denied CIDR ranges.
source_ip.fail_closedboolean是Whether the route fails closed when the filter cannot be evaluated.
statusstring是Service status (active or offline).
vipstring是Backend VIP/host.
virtual_portinteger | null否Overlay virtual port used for ACL authoring.
{
  "backend_hint": "example",
  "backend_public_edge_ready": false,
  "custom_domain": "web.example-network.svc.ns.io",
  "domain": "web.example-network.svc.ns.io",
  "gateway_binding": {
    "auto_bound": false,
    "gateway_id": "01K4EXAMPLE0000000000000",
    "id": "01K4EXAMPLE0000000000000",
    "mode": "example",
    "priority": 1,
    "service_id": "01K4SERVICE00000000000000"
  },
  "id": "01K4EXAMPLE0000000000000",
  "last_sync_at": "2026-09-09T10:00:00Z",
  "listen_hint": "example",
  "name": "示例资源",
  "protocol": "tcp",
  "public_edge": {
    "exposed": false,
    "public_host": "example",
    "routing_gateway_id": "01K4EXAMPLE0000000000000",
    "subject_policy": {}
  },
  "public_virtual_port": 1,
  "reported_by": "n-01K4NODE000000000000000",
  "short_dns_canonical_name": "example",
  "site_id": "01K4EXAMPLE0000000000000",
  "source_ip": {
    "allow_cidrs": [
      {}
    ],
    "deny_cidrs": [
      {}
    ],
    "fail_closed": false
  },
  "status": "active",
  "vip": "100.64.0.12",
  "virtual_port": 1
}

错误响应均使用 Problem Details;调用方应判断 HTTP 状态和稳定的 code,不要解析 detail 文案。

修改服务元数据

PATCH/api/v1/services/{id}full

参数

名称位置类型必填说明
idpathstring是Service ULID

请求体

request.json
{}

请求示例

curl --silent --show-error --fail-with-body -X PATCH \
  "$NSD_BASE_URL/services/${SERVICE_ID}" \
  -H "Authorization: Bearer $NSD_TOKEN" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data @request.json

响应状态

状态含义响应结构
204Public-edge overlay updated—
400Invalid input (e.g. exposed without public_host)ProblemDetails
401缺少或无效的 Bearer 令牌。ProblemDetails
404当前 Network 中不存在该服务。ProblemDetails
409public_host already in use by another serviceProblemDetails

204 响应

成功,无响应体。

错误响应均使用 Problem Details;调用方应判断 HTTP 状态和稳定的 code,不要解析 detail 文案。

删除服务

DELETE/api/v1/services/{id}full

参数

名称位置类型必填说明
idpathstring是Service ULID

请求体

字段类型必填说明
confirmationstring是Must equal DELETE <service-name> from the latest impact preview.
expected_updated_atstring是Exact service update timestamp returned by the latest impact preview.
request.json
{
  "confirmation": "example",
  "expected_updated_at": "2026-09-09T10:00:00Z"
}

请求示例

curl --silent --show-error --fail-with-body -X DELETE \
  "$NSD_BASE_URL/services/${SERVICE_ID}" \
  -H "Authorization: Bearer $NSD_TOKEN" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data @request.json

响应状态

状态含义响应结构
200Service retired and service-owned overlays removedDeleteServiceResponse
400Typed confirmation is invalidProblemDetails
401缺少或无效的 Bearer 令牌。ProblemDetails
404当前 Network 中不存在该服务。ProblemDetails
409Service changed or is still referencedProblemDetails

200 响应

字段类型必有说明
deletedboolean是Always true on success.
summaryServiceRetirementSummaryView是Removed-row summary.
summary.identity_import_rowsinteger是Number of identity-import rows removed.
summary.overlay_virtual_portinteger | null否Released overlay port, if any.
summary.overlay_virtual_port_rowsinteger是Number of overlay virtual-port rows removed.
summary.public_edge_rowsinteger是Number of inactive public-edge rows removed.
summary.public_virtual_portinteger | null否Released public listener port, if any.
summary.service_idstring是Retired service ULID.
summary.service_namestring是Retired service name.
summary.source_ip_rowsinteger是Number of source-IP rows removed.
{
  "deleted": false,
  "summary": {
    "identity_import_rows": 1,
    "overlay_virtual_port": 1,
    "overlay_virtual_port_rows": 1,
    "public_edge_rows": 1,
    "public_virtual_port": 1,
    "service_id": "01K4SERVICE00000000000000",
    "service_name": "example",
    "source_ip_rows": 1
  }
}

错误响应均使用 Problem Details;调用方应判断 HTTP 状态和稳定的 code,不要解析 detail 文案。

列出网关

GET/api/v1/gatewaysread-only / full

参数

名称位置类型必填说明
cursorquerystring | null否Opaque cursor — the last id of the previous page. Absent on page 1.
limitqueryinteger | null否Requested page size; clamped to 1..=MAX_LIMIT.

请求示例

curl --silent --show-error --fail-with-body -X GET \
  "$NSD_BASE_URL/gateways?limit=100" \
  -H "Authorization: Bearer $NSD_TOKEN" \
  -H 'Accept: application/json'

响应状态

状态含义响应结构
200Paginated list of gateways visible to the caller's realmListGatewaysResponse
401缺少或无效的 Bearer 令牌。ProblemDetails

200 响应

字段类型必有说明
itemsarray<GatewayView>是Gateways in this page.
items[].addrstring | null否Tunnel address.
items[].archstring | null否CPU architecture.
items[].connectionsinteger是Reported connections.
items[].drainedboolean是Whether gateway is drained.
items[].endpointstring是Preferred endpoint.
items[].envoy_http_public_portinteger | null否Public HTTP port.
items[].health_check_pathstring是Health-check path.
items[].idstring是Gateway ULID.
items[].kindstring是Kind, always NSGW.
items[].last_seenstring | null否Last heartbeat timestamp.
items[].latency_p99integer是Placeholder p99 latency.
items[].max_connectionsinteger是Max configured connections.
items[].namestring是Gateway name.
items[].operatorstring是Operator label.
items[].osstring | null否Operating system.
items[].owner_user_idstring | null否Owner user ULID.
items[].peer_key_pubstring是Peer public key.
items[].pubkey_ed25519string是Machine public key.
items[].public_edgeboolean | null否Whether this gateway can serve public HTTP edge.
items[].public_edge_l4boolean | null否Whether this gateway can serve public L4 edge.
items[].realm_idstring是Realm ULID.
items[].regionstring | null否Region.
items[].registered_atstring是Registration timestamp.
items[].sharedboolean | null否Whether this gateway is shared into the viewer realm.
items[].site_idstring | null否Site ULID.
items[].tagsarray<string>是Tags.
items[].transportstring | null否Primary transport.
items[].transportsarray<string>是Available transports.
items[].tunnel_ipstring | null否Tunnel IP.
items[].versionstring | null否Reported version.
items[].wg_endpointstring | null否WireGuard endpoint.
items[].wss_endpointstring | null否WSS endpoint.
items[].wss_relaystring | null否WSS relay URL on detail responses.
next_cursorstring | null否Cursor for the next page, or null.
{
  "items": [
    {
      "addr": "100.64.0.12",
      "arch": "example",
      "connections": 1,
      "drained": false,
      "endpoint": "gateway.example.com:51820",
      "envoy_http_public_port": 1,
      "health_check_path": "example",
      "id": "01K4EXAMPLE0000000000000",
      "kind": "static",
      "last_seen": "example",
      "latency_p99": 1,
      "max_connections": 1,
      "name": "示例资源",
      "operator": "example",
      "os": "example",
      "owner_user_id": "01K4USER000000000000000000",
      "peer_key_pub": "example",
      "pubkey_ed25519": "example",
      "public_edge": false,
      "public_edge_l4": false,
      "realm_id": "01K4EXAMPLE0000000000000",
      "region": "example",
      "registered_at": "2026-09-09T10:00:00Z",
      "shared": false,
      "site_id": "01K4EXAMPLE0000000000000",
      "tags": [
        {}
      ],
      "transport": "example",
      "transports": [
        {}
      ],
      "tunnel_ip": "100.64.0.12",
      "version": "v1",
      "wg_endpoint": "gateway.example.com:51820",
      "wss_endpoint": "gateway.example.com:51820",
      "wss_relay": "example"
    }
  ],
  "next_cursor": "example"
}

错误响应均使用 Problem Details;调用方应判断 HTTP 状态和稳定的 code,不要解析 detail 文案。

读取网关

GET/api/v1/gateways/{id}read-only / full

参数

名称位置类型必填说明
idpathstring是Gateway machine ULID

请求示例

curl --silent --show-error --fail-with-body -X GET \
  "$NSD_BASE_URL/gateways/${GATEWAY_ID}" \
  -H "Authorization: Bearer $NSD_TOKEN" \
  -H 'Accept: application/json'

响应状态

状态含义响应结构
200The gatewayGatewayView
401缺少或无效的 Bearer 令牌。ProblemDetails
404当前 Network 中不存在该网关。ProblemDetails

200 响应

字段类型必有说明
addrstring | null否Tunnel address.
archstring | null否CPU architecture.
connectionsinteger是Reported connections.
drainedboolean是Whether gateway is drained.
endpointstring是Preferred endpoint.
envoy_http_public_portinteger | null否Public HTTP port.
health_check_pathstring是Health-check path.
idstring是Gateway ULID.
kindstring是Kind, always NSGW.
last_seenstring | null否Last heartbeat timestamp.
latency_p99integer是Placeholder p99 latency.
max_connectionsinteger是Max configured connections.
namestring是Gateway name.
operatorstring是Operator label.
osstring | null否Operating system.
owner_user_idstring | null否Owner user ULID.
peer_key_pubstring是Peer public key.
pubkey_ed25519string是Machine public key.
public_edgeboolean | null否Whether this gateway can serve public HTTP edge.
public_edge_l4boolean | null否Whether this gateway can serve public L4 edge.
realm_idstring是Realm ULID.
regionstring | null否Region.
registered_atstring是Registration timestamp.
sharedboolean | null否Whether this gateway is shared into the viewer realm.
site_idstring | null否Site ULID.
tagsarray<string>是Tags.
transportstring | null否Primary transport.
transportsarray<string>是Available transports.
tunnel_ipstring | null否Tunnel IP.
versionstring | null否Reported version.
wg_endpointstring | null否WireGuard endpoint.
wss_endpointstring | null否WSS endpoint.
wss_relaystring | null否WSS relay URL on detail responses.
{
  "addr": "100.64.0.12",
  "arch": "example",
  "connections": 1,
  "drained": false,
  "endpoint": "gateway.example.com:51820",
  "envoy_http_public_port": 1,
  "health_check_path": "example",
  "id": "01K4EXAMPLE0000000000000",
  "kind": "static",
  "last_seen": "example",
  "latency_p99": 1,
  "max_connections": 1,
  "name": "示例资源",
  "operator": "example",
  "os": "example",
  "owner_user_id": "01K4USER000000000000000000",
  "peer_key_pub": "example",
  "pubkey_ed25519": "example",
  "public_edge": false,
  "public_edge_l4": false,
  "realm_id": "01K4EXAMPLE0000000000000",
  "region": "example",
  "registered_at": "2026-09-09T10:00:00Z",
  "shared": false,
  "site_id": "01K4EXAMPLE0000000000000",
  "tags": [
    "example"
  ],
  "transport": "example",
  "transports": [
    "example"
  ],
  "tunnel_ip": "100.64.0.12",
  "version": "v1",
  "wg_endpoint": "gateway.example.com:51820",
  "wss_endpoint": "gateway.example.com:51820",
  "wss_relay": "example"
}

错误响应均使用 Problem Details;调用方应判断 HTTP 状态和稳定的 code,不要解析 detail 文案。

返回 API 参考总览。