{"openapi":"3.1.0","info":{"title":"Converge Cloud — Cloud Firewall (cfw)","version":"2019-09-04","summary":"4 actions.","description":"Endpoint `https://cfw.api3.convergecloud.com`, region `luzon`, `X-TC-Version: 2019-09-04`.\n\nA wrong `X-TC-Version` returns `InvalidAction`, which is indistinguishable from a missing action — this was the single largest source of false “absent” verdicts in our own measurements."},"servers":[{"url":"https://cfw.api3.convergecloud.com","description":"Converge Cloud production (luzon — the only region)"}],"x-cc-wire-protocol":{"style":"RPC over HTTP POST","realPath":"/","actionHeader":"X-TC-Action","versionHeader":"X-TC-Version","version":"2019-09-04","note":"Every operation in this document is really `POST /` to the server above with `X-TC-Action: <Action>`. Paths of the form `/cfw/<Action>` exist so the actions are individually addressable, linkable and renderable; they are not routes on the server.","signing":"TC3-HMAC-SHA256","region":"luzon","clockSkewSeconds":300},"security":[{"TC3":[]}],"tags":[{"name":"cfw","description":"Cloud Firewall"}],"paths":{"/cfw/DescribeDefenseSwitch":{"post":{"operationId":"cfw_DescribeDefenseSwitch","summary":"DescribeDefenseSwitch","description":"Query the list of firewall toggles with Intrusion Defense enabled.\n**Wire call.** This path is a documentation convenience. Converge Cloud is RPC-over-HTTP: every action is a single `POST /` to `cfw.api3.convergecloud.com` with the action name in the `X-TC-Action` header. The real request is:\n```bash\ncurl -sS https://cfw.api3.convergecloud.com/ \\\n  -H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/cfw/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \\\n  -H 'Content-Type: application/json; charset=utf-8' \\\n  -H 'Host: cfw.api3.convergecloud.com' \\\n  -H 'X-TC-Action: DescribeDefenseSwitch' \\\n  -H 'X-TC-Version: 2019-09-04' \\\n  -H 'X-TC-Timestamp: <unix-seconds>' \\\n  -H 'X-TC-Region: luzon' \\\n  -d '{}'\n```","tags":["cfw"],"deprecated":false,"x-cc-service":"cfw","x-cc-action":"DescribeDefenseSwitch","x-cc-version":"2019-09-04","x-cc-mutating":false,"x-cc-required-params":[],"x-cc-notable-params":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{},"additionalProperties":true,"description":"The fields listed here are the ones in common use. Additional parameters are also accepted."}}}},"responses":{"200":{"description":"Converge Cloud answers 200 for both success and error. Read `Response.Error` to tell them apart — never the HTTP status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"},"examples":{"recorded1":{"summary":"Example response","value":{"BaselineAllSwitch":0,"BasicRuleSwitch":0,"HistoryOpen":0,"RequestId":"163cb3c8-d744-2c88-3c46-ccee32c6d332","ReturnCode":0,"ReturnMsg":"success","TiSwitch":0,"VirtualPatchSwitch":0}}}}}}}}},"/cfw/DescribeNatFwInstance":{"post":{"operationId":"cfw_DescribeNatFwInstance","summary":"DescribeNatFwInstance","description":"Get all NAT instances of a tenant.\n**Wire call.** This path is a documentation convenience. Converge Cloud is RPC-over-HTTP: every action is a single `POST /` to `cfw.api3.convergecloud.com` with the action name in the `X-TC-Action` header. The real request is:\n```bash\ncurl -sS https://cfw.api3.convergecloud.com/ \\\n  -H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/cfw/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \\\n  -H 'Content-Type: application/json; charset=utf-8' \\\n  -H 'Host: cfw.api3.convergecloud.com' \\\n  -H 'X-TC-Action: DescribeNatFwInstance' \\\n  -H 'X-TC-Version: 2019-09-04' \\\n  -H 'X-TC-Timestamp: <unix-seconds>' \\\n  -H 'X-TC-Region: luzon' \\\n  -d '{}'\n```","tags":["cfw"],"deprecated":false,"x-cc-service":"cfw","x-cc-action":"DescribeNatFwInstance","x-cc-version":"2019-09-04","x-cc-mutating":false,"x-cc-required-params":[],"x-cc-notable-params":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{},"additionalProperties":true,"description":"The fields listed here are the ones in common use. Additional parameters are also accepted."}}}},"responses":{"200":{"description":"Converge Cloud answers 200 for both success and error. Read `Response.Error` to tell them apart — never the HTTP status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"},"examples":{"recorded1":{"summary":"Example response","value":{"NatinsLst":[],"RequestId":"762795de-4143-0fcf-1ff1-4561f3fb5980"}}}}}}}}},"/cfw/DescribeNatFwInstancesInfo":{"post":{"operationId":"cfw_DescribeNatFwInstancesInfo","summary":"DescribeNatFwInstancesInfo","description":"Get all NAT instances and instance card information of a tenant.\n**Wire call.** This path is a documentation convenience. Converge Cloud is RPC-over-HTTP: every action is a single `POST /` to `cfw.api3.convergecloud.com` with the action name in the `X-TC-Action` header. The real request is:\n```bash\ncurl -sS https://cfw.api3.convergecloud.com/ \\\n  -H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/cfw/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \\\n  -H 'Content-Type: application/json; charset=utf-8' \\\n  -H 'Host: cfw.api3.convergecloud.com' \\\n  -H 'X-TC-Action: DescribeNatFwInstancesInfo' \\\n  -H 'X-TC-Version: 2019-09-04' \\\n  -H 'X-TC-Timestamp: <unix-seconds>' \\\n  -H 'X-TC-Region: luzon' \\\n  -d '{}'\n```","tags":["cfw"],"deprecated":false,"x-cc-service":"cfw","x-cc-action":"DescribeNatFwInstancesInfo","x-cc-version":"2019-09-04","x-cc-mutating":false,"x-cc-required-params":[],"x-cc-notable-params":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{},"additionalProperties":true,"description":"The fields listed here are the ones in common use. Additional parameters are also accepted."}}}},"responses":{"200":{"description":"Converge Cloud answers 200 for both success and error. Read `Response.Error` to tell them apart — never the HTTP status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"},"examples":{"recorded1":{"summary":"Example response","value":{"NatinsLst":[],"RequestId":"40fdcaf8-df91-db86-0a66-c3f111545c38","Total":0}}}}}}}}},"/cfw/DescribeSourceAsset":{"post":{"operationId":"cfw_DescribeSourceAsset","summary":"DescribeSourceAsset","description":"Get all asset information of an asset group.\n**Wire call.** This path is a documentation convenience. Converge Cloud is RPC-over-HTTP: every action is a single `POST /` to `cfw.api3.convergecloud.com` with the action name in the `X-TC-Action` header. The real request is:\n```bash\ncurl -sS https://cfw.api3.convergecloud.com/ \\\n  -H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/cfw/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \\\n  -H 'Content-Type: application/json; charset=utf-8' \\\n  -H 'Host: cfw.api3.convergecloud.com' \\\n  -H 'X-TC-Action: DescribeSourceAsset' \\\n  -H 'X-TC-Version: 2019-09-04' \\\n  -H 'X-TC-Timestamp: <unix-seconds>' \\\n  -H 'X-TC-Region: luzon' \\\n  -d '{}'\n```","tags":["cfw"],"deprecated":false,"x-cc-service":"cfw","x-cc-action":"DescribeSourceAsset","x-cc-version":"2019-09-04","x-cc-mutating":false,"x-cc-required-params":[],"x-cc-notable-params":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{},"additionalProperties":true,"description":"The fields listed here are the ones in common use. Additional parameters are also accepted."}}}},"responses":{"200":{"description":"Converge Cloud answers 200 for both success and error. Read `Response.Error` to tell them apart — never the HTTP status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"},"examples":{"recorded1":{"summary":"Example response","value":{"Data":[],"RequestId":"cc5c9c4d-05b6-4378-3859-07000ab74fa7","Total":0,"ZoneList":[]}}}}}}}}}},"components":{"securitySchemes":{"TC3":{"type":"apiKey","in":"header","name":"Authorization","description":"TC3-HMAC-SHA256. Credential scope is `<YYYY-MM-DD>/cfw/tc3_request`. The signing service name is a separate input from the hostname — deriving it from the host works until it does not, and the failure looks like an auth bug. Timestamps outside a 300-second window are rejected."}},"schemas":{"Envelope":{"type":"object","description":"Every Converge Cloud response is wrapped in `Response`, success or failure.","properties":{"Response":{"type":"object","properties":{"RequestId":{"type":"string","description":"Always present, including on errors. Quote it to Converge support."},"Error":{"$ref":"#/components/schemas/Error"}},"required":["RequestId"],"additionalProperties":true}},"required":["Response"]},"Error":{"type":"object","description":"Present only on failure. Error messages are Chinese on vpc and dc and English elsewhere — parse `Code`, never `Message`.","properties":{"Code":{"type":"string","examples":["InvalidAction","UnauthorizedOperation","AuthFailure.SignatureFailure","ResourceNotFound","InvalidParameterValue.LimitExceeded"]},"Message":{"type":"string"}},"required":["Code","Message"]}}}}