v.34.1

docs/API.md

@@ -13,6 +13,9 @@ The current bundled `src/admin/openapi.json` declares these operations (among ot
 | `POST /api/auth/login` · `POST /api/auth/logout` | Start/end a browser admin session. |
 | `GET /api/auth/session` | Validate current admin session. |
 | `GET /api/config` · `PUT /api/config` | Read or replace validated, revisioned configuration. |
+| `POST /api/config/reload` | Revalidate and hot-reload manually changed `--config` JSON; revision-aware. |
+| `GET/POST /api/api-tokens` · `DELETE /api/api-tokens/{id}` | List/generate/revoke general RO/RW API tokens (browser-admin-only). |
+| `GET/POST/DELETE /api/prometheus-token` | Inspect/generate/rotate/revoke a standalone Prometheus scrape token (browser-admin-only). |
 | `PUT /api/config/{section}` | Update one supported configuration section. |
 | `GET /api/config/history` · `POST /api/config/history/restore` | Review/restore retained configuration snapshots. |
 | `GET /api/status` · `GET /api/backends` | Operational status and backend observations. |
@@ -31,7 +34,7 @@ Some paths have additional DELETE/PATCH operations, job-status resources, query
 
 ## Authentication and safe writes
 
-- Ordinary API calls require an administrator browser/session cookie on the admin listener. Logging in also provides CSRF context. Writes require correct Host/Origin, `X-CSRF-Token` and `X-RustProxy-Request: 1` as enforced by the server.
+- Ordinary API calls require an administrator browser/session cookie on the admin listener, or a scoped general API Bearer token for explicitly allowlisted API methods/paths. Logging in also provides CSRF context. Writes require correct Host/Origin, `X-CSRF-Token` and `X-RustProxy-Request: 1` as enforced by the server.
 - The Swagger **API** tab uses the signed-in session. Read calls can be executed; mutations require explicit confirmation. It cannot bypass server-side authorization.
 - Configuration writes are revisioned (`expected_revision`) and rejected if based on a stale save. Prefer section updates over replacing the entire document when practical.
 - `/docs`, API schemas, configuration, logs, certificates and most observations are **not anonymous**. Keep the listener restricted and use HTTPS or a tunnel for remote access.