> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Apply cilium config > Which flow scopes this caller can address — the read that lets a flow page **Authorisation:** `cilium:Apply` on `krn:celum:supervisor:{name}:cilium:*`. ## OpenAPI ````yaml /openapi.json post /api/supervisors/{name}/cilium/apply openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/supervisors/{name}/cilium/apply: post: tags: - networking summary: Apply cilium config description: >- Which flow scopes this caller can address — the read that lets a flow page **Authorisation:** `cilium:Apply` on `krn:celum:supervisor:{name}:cilium:*`. operationId: post_supervisors_byName_cilium_apply parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/k8s.CiliumNetworkValues.Input' required: true responses: '200': description: 'OK. The body is not described: the code sends map[string]any.' '400': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Request. '401': description: Not authenticated — no valid session cookie or API token. '403': description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '500': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Internal Server Error. components: schemas: k8s.CiliumNetworkValues.Input: properties: bgp: $ref: '#/components/schemas/k8s.BGPValues.Input' l2: $ref: '#/components/schemas/k8s.L2Values.Input' lb: $ref: '#/components/schemas/k8s.LBValues.Input' type: object x-go-type: backend/internal/k8s.CiliumNetworkValues api.ErrorBody: properties: error: type: string required: - error type: object k8s.BGPValues.Input: properties: advertisements: items: $ref: '#/components/schemas/k8s.BGPAdvertValues.Input' nullable: true type: array enabled: type: boolean localASN: format: int64 type: integer nodeOverrides: items: $ref: '#/components/schemas/k8s.BGPNodeOverrideValues.Input' nullable: true type: array nodeSelector: additionalProperties: type: string nullable: true type: object peers: items: $ref: '#/components/schemas/k8s.BGPPeerValues.Input' nullable: true type: array type: object x-go-type: backend/internal/k8s.BGPValues k8s.L2Values.Input: properties: enabled: type: boolean externalIPs: type: boolean interfaces: items: type: string nullable: true type: array loadBalancerIPs: type: boolean nodeSelector: additionalProperties: type: string nullable: true type: object serviceSelector: additionalProperties: type: string nullable: true type: object type: object x-go-type: backend/internal/k8s.L2Values k8s.LBValues.Input: properties: enabled: type: boolean pools: items: $ref: '#/components/schemas/k8s.LBPoolValues.Input' nullable: true type: array type: object x-go-type: backend/internal/k8s.LBValues k8s.BGPAdvertValues.Input: properties: advertisementType: type: string aggregationLengthIPv4: format: int64 type: integer largeCommunities: items: type: string nullable: true type: array localPreference: format: int64 type: integer name: type: string selector: additionalProperties: type: string nullable: true type: object serviceAddresses: items: type: string nullable: true type: array standardCommunities: items: type: string nullable: true type: array wellKnownCommunities: items: type: string nullable: true type: array type: object x-go-type: backend/internal/k8s.BGPAdvertValues k8s.BGPNodeOverrideValues.Input: properties: localASN: format: int64 type: integer localAddress: type: string nodeName: type: string routerID: type: string type: object x-go-type: backend/internal/k8s.BGPNodeOverrideValues k8s.BGPPeerValues.Input: properties: autoDiscovery: allOf: - $ref: '#/components/schemas/k8s.BGPAutoDiscovery.Input' nullable: true type: object name: type: string peerASN: format: int64 type: integer peerAddress: type: string peerConfig: allOf: - $ref: '#/components/schemas/k8s.BGPPeerConfigValues.Input' nullable: true type: object peerConfigRef: type: string type: object x-go-type: backend/internal/k8s.BGPPeerValues k8s.LBPoolValues.Input: properties: allowFirstLastIPs: type: string cidr: type: string disabled: type: boolean labels: additionalProperties: type: string nullable: true type: object name: type: string serviceSelector: additionalProperties: type: string nullable: true type: object start: type: string stop: type: string type: object x-go-type: backend/internal/k8s.LBPoolValues k8s.BGPAutoDiscovery.Input: properties: addressFamily: type: string mode: type: string type: object x-go-type: backend/internal/k8s.BGPAutoDiscovery k8s.BGPPeerConfigValues.Input: properties: authSecretRef: type: string connectRetryTimeSeconds: format: int64 type: integer ebgpMultihop: format: int64 type: integer gracefulRestart: type: boolean holdTimeSeconds: format: int64 type: integer keepAliveTimeSeconds: format: int64 type: integer name: type: string restartTimeSeconds: format: int64 type: integer type: object x-go-type: backend/internal/k8s.BGPPeerConfigValues securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.