v0.3

docs/API.md

@@ -12,7 +12,7 @@ The current bundled `src/admin/openapi.json` declares these operations (among ot
 | `GET /api/auth/status` | Whether first-time administrator setup is required. |
 | `POST /api/auth/login` · `POST /api/auth/logout` | Start/end a browser admin session. |
 | `GET /api/auth/session` | Validate current admin session. |
-| `GET /api/config` · `PUT /api/config` | Read or replace validated, revisioned configuration. |
+| `GET /api/config` · `PUT /api/config` | Read or replace validated, revisioned configuration. GET also returns read-only `storage` metadata (SQLite/JSON source and paths). |
 | `POST /api/config/reload` | Revalidate and hot-reload manually changed `--config` JSON; revision-aware. |
 | `GET/POST /api/api-tokens` · `DELETE /api/api-tokens/{id}` | List/generate/revoke general RO/RW API tokens (browser-admin-only). |
 | `GET/POST/DELETE /api/prometheus-token` | Inspect/generate/rotate/revoke a standalone Prometheus scrape token (browser-admin-only). |
@@ -36,7 +36,7 @@ Some paths have additional DELETE/PATCH operations, job-status resources, query
 
 - Ordinary API calls require an administrator browser/session cookie on the admin listener, or a scoped general API Bearer token for explicitly allowlisted API methods/paths. Logging in also provides CSRF context. Writes require correct Host/Origin, `X-CSRF-Token` and `X-RustProxy-Request: 1` as enforced by the server.
 - The Swagger **API** tab uses the signed-in session. Read calls can be executed; mutations require explicit confirmation. It cannot bypass server-side authorization.
-- Configuration writes are revisioned (`expected_revision`) and rejected if based on a stale save. Prefer section updates over replacing the entire document when practical.
+- Configuration writes are revisioned (`expected_revision`) and rejected if based on a stale save. `GET /api/config` returns `{revision, config, storage}`; `storage` is runtime metadata and must not be copied inside the editable `config` object or included as a write parameter. PUT and history-restore responses remain `{revision, config}`. Prefer section updates over replacing the entire document when practical.
 - `/docs`, API schemas, configuration, logs, certificates and most observations are **not anonymous**. Keep the listener restricted and use HTTPS or a tunnel for remote access.
 
 ## Local CLI alternatives