# Dedicated OpenAPI Operation Map

Swagger source:

- `tidb-management-service/api/spec/tidb_cloud_open_api/dedicated/v1beta1/services.swagger.json`

Base URL for the cp9 Dev full session:

- `TC_DEDICATED_OPENAPI_BASE_URL=https://127.0.0.1:18443/dedicated/v1beta1`

The Dev full session gateway routes `/dedicated/v1beta1` to `tidb-mgmt-portal:8080`, matching staging Kong preprocessing for `https://dedicated.tidbapi.com/v1beta1`.

| Operation ID | Method | Path | Notes |
| --- | --- | --- | --- |
| `RegionService_ListRegions` | GET | `/regions` | Read-only region discovery. |
| `RegionService_GetRegion` | GET | `/regions/{regionId}` | Read-only region detail. |
| `RegionService_ListNodeSpecs` | GET | `/regions/{regionId}/nodeSpecs` | Read-only SKU discovery. |
| `RegionService_ShowCloudProviders` | GET | `/regions:showCloudProviders` | Read-only provider discovery. |
| `ClusterService_ListClusters` | GET | `/clusters` | Read-only cluster list and post-delete absence check. |
| `NetworkContainerService_ListNetworkContainers` | GET | `/networkContainers` | Equivalent Dedicated API CIDR lookup; use the same project/provider/region scope and record the persistent row. The shipped dbaas-ui proof instead uses legacy `/api/v1/orgs/{org}/projects/{project}/cidrs`. |
| `NetworkContainerService_CreateNetworkContainer` | POST | `/networkContainers` | Equivalent Dedicated API CIDR create; one reviewed create only when the scoped row is absent, followed by read-back. It maps to DGS `CreateCidr`; it is not a replacement for the shipped UI route. |
| `ClusterService_CreateCluster` | POST | `/clusters` | Mutating; require reviewed body, owner/session labels, cleanup plan, and bounded polling. |
| `ClusterService_GetCluster` | GET | `/clusters/{clusterId}` | Poll to stable observable state such as `ACTIVE`. |
| `ClusterService_DeleteCluster` | DELETE | `/clusters/{clusterId}` | Destructive; require pre-delete GET/list and post-delete list absence or documented visibility quirk. |
| `TidbNodeGroupService_ListTidbNodeGroups` | GET | `/clusters/{clusterId}/tidbNodeGroups` | Read-only node group and endpoint discovery. |
| `TidbNodeGroupService_GetPublicEndpointSetting` | GET | `/clusters/{clusterId}/tidbNodeGroups/{tidbNodeGroupId}/publicEndpointSetting` | Read-only public endpoint state. |
| `TidbNodeGroupService_UpdatePublicEndpointSetting` | PATCH | `/clusters/{clusterId}/tidbNodeGroups/{tidbNodeGroupId}/publicEndpointSetting` | Mutating public endpoint toggle; require SQL proof and cleanup policy. |

Use private endpoint, CMEK, maintenance, or audit-log operations only with explicit authority and exact targets because they can create cloud resources or expose sensitive configuration. For network containers, choose the equivalent Dedicated API or the shipped UI's legacy CIDR surface explicitly; in either case, list first, create once only when absent, read back, and never delete the persistent project-region row during cluster/session cleanup.

The shipped UI legacy pair is `GET /api/v1/orgs/{org}/projects/{project}/cidrs?provider=AWS`, `POST /api/v1/orgs/{org}/projects/{project}/cidrs` without that query, then the same GET for read-back.