overlay: 1.0.0
info:
  title: API Evangelist enhancements for Ant Media Server Management Panel REST API Cluster API
  version: 1.0.0
extends: ant-media-cluster-api-openapi.yml
x-provenance:
  generated: '2026-09-02'
  method: generated
  source: Authored by API Evangelist from https://docs.antmedia.io/ and live probes 2026-09-02. Applies on top of the vendor
    spec; the vendor spec is never mutated.
actions:
- target: $.components.securitySchemes
  description: The published specs declare no securitySchemes at all, though the docs document JWT bearer auth on the application
    REST API and a ProxyAuthorization JWT plus a JSESSIONID session on the management API. This overlay states the auth model
    the documentation defines.
  update:
    managementJwt:
      type: apiKey
      in: header
      name: ProxyAuthorization
      description: JWT signed HS256 with server.jwtServerSecretKey. No "Bearer" prefix. https://docs.antmedia.io/guides/developer-sdk-and-api/rest-api-guide/management-rest-apis/
    managementSession:
      type: apiKey
      in: cookie
      name: JSESSIONID
      description: Session cookie returned by POST /v2/users/authenticate (email + MD5 password).
- target: $.info
  description: Record that the failure signal in this API is the Result body, not the HTTP status.
  update:
    x-error-envelope:
      schema: Result
      fields:
      - success
      - message
      - dataId
      - errorId
      note: Most operations declare only HTTP 200. A failure normally arrives as 200 with success=false. Clients MUST read
        Result.success. See errors/ant-media-problem-types.yml.
    x-rate-limits:
      published: false
      note: No rate-limit headers, no 429, no published quota. See rate-limits/ant-media-rate-limits.yml.
    x-reversibility:
      see: conventions/ant-media-conventions.yml