Merge branch 'main' into embedded-vnc

shared/management/http/api/openapi.yml

@@ -6456,6 +6456,44 @@ components:
         - enable_prompt_collection
         - redact_pii
         - access_log_retention_days
+    AgentNetworkManagedProxy:
+      type: object
+      description: A NetBird-managed Agent Network gateway deployment.
+      properties:
+        id:
+          type: string
+          description: Managed proxy deployment ID.
+          example: "d1m3kebd9pcs0c1pnu7g"
+        state:
+          type: string
+          description: Derived deployment state. `provisioning` until the gateway is rolled out and connected, `ready` while the gateway actively serves the endpoint, `failed` when the rollout reported a failure.
+          enum: [ "provisioning", "ready", "failed" ]
+          example: "ready"
+        endpoint:
+          type: string
+          description: The account's gateway hostname.
+          example: "brave-otter.gateway.netbird.io"
+        region:
+          type: string
+          description: Region of the cluster hosting the deployment.
+          example: "us-east"
+        message:
+          type: string
+          description: Failure detail reported by the rollout. Only set when state is `failed`.
+      required:
+        - id
+        - state
+        - endpoint
+    AgentNetworkManagedProxyConflict:
+      type: object
+      description: Conflict body returned when the account already has an Agent Network endpoint that managed provisioning does not own, naming that endpoint.
+      properties:
+        endpoint:
+          type: string
+          description: The Agent Network endpoint already assigned to the account.
+          example: "llm.example.com"
+      required:
+        - endpoint
     AgentNetworkBudgetRule:
       type: object
       description: Account-level budget rule. A limit-only rule bound to groups and/or users that applies across all policies as a min-wins ceiling. Empty targets means it applies to every caller.
@@ -13544,6 +13582,67 @@ paths:
           "$ref": "#/components/responses/not_found"
         '500':
           "$ref": "#/components/responses/internal_error"
+  /api/integrations/agent-network/managed-proxy:
+    post:
+      summary: Provision a managed Agent Network gateway
+      description: Starts provisioning of a NetBird-managed Agent Network gateway for the account, allocating its endpoint under the managed zone on the first call. Idempotent — answers 202 when this call started (or, after a failure, restarted) provisioning and 200 when a deployment already exists, reporting current state either way. Returns 409 when the account already has an Agent Network endpoint that managed provisioning does not own, and 503 when endpoint allocation is temporarily exhausted.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A managed gateway deployment already exists; reports its current state.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxy'
+        '202':
+          description: Provisioning started, or restarted after a reported failure
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxy'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '409':
+          description: The account already has an Agent Network endpoint not owned by managed provisioning
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxyConflict'
+        '500':
+          "$ref": "#/components/responses/internal_error"
+        '503':
+          description: Endpoint allocation is temporarily exhausted; retry later
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+    get:
+      summary: Retrieve managed Agent Network gateway status
+      description: Reports the account's managed gateway deployment and its derived state. Returns 404 when the account has no managed deployment.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: The account's managed gateway deployment
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxy'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
   /api/agent-network/access-logs:
     get:
       summary: List Agent Network access logs