docs: remove references to unsupported API7 EE resources (upstream, consumer_group, plugin_config)

API7 EE does not expose REST API endpoints for standalone upstreams,
consumer groups, or plugin configs. Update all documentation to reflect
this: remove deleted pages from directory listings, add NOT EXPOSED
notices, update resource counts (16→13), fix declarative config examples
to use inline upstreams, and document the limitation in AGENTS.md.

Author: moonming

AGENTS.md

@@ -35,7 +35,7 @@ a7/
 │   ├── root/root.go              # Root command registration
 │   ├── factory.go                # Factory DI container
 │   ├── route/                    # Published route commands
-│   ├── upstream/                 # Published upstream commands
+│   ├── upstream/                 # ⚠️ NOT EXPOSED in API7 EE — upstreams are inline-only (code kept for potential future support)
 │   ├── service/                  # Published service commands
 │   ├── consumer/                 # Consumer commands
 │   ├── ssl/                      # SSL certificate commands
@@ -106,6 +106,14 @@ a7/
 - PATCH endpoints use JSON Patch (RFC 6902) arrays, not merge-patch.
 - Enterprise-specific resources: gateway groups, service templates, RBAC (users/roles/policies), developer portal, audit logs, custom plugins, service registries, tokens.
 
+### Resources NOT Exposed in API7 EE
+The following APISIX resources do **not** have REST API endpoints in API7 Enterprise Edition:
+- **Standalone Upstream** (`/apisix/admin/upstreams`): Returns "resource not found". Upstreams exist only inline within services and routes.
+- **Consumer Group** (`/apisix/admin/consumer_groups`): No endpoint exposed.
+- **Plugin Config** (`/apisix/admin/plugin_configs`): No endpoint exposed.
+
+The `pkg/cmd/upstream/` code directory is kept for potential future support, but these commands are non-functional against API7 EE.
+
 ### How to Add a New Command
 1. Read `PRD.md` for the resource spec and `docs/api7ee-api-spec.md` for the API.
 2. Create types in `pkg/api/types_<resource>.go`.

PRD.md

@@ -16,7 +16,7 @@
 ## Goals and Non-Goals
 
 ### Goals
-- Provide full CRUD operations for all API7 EE resources (both control-plane `/api/*` and APISIX admin `/apisix/admin/*` endpoints).
+- Provide full CRUD operations for all API7 EE resources (both control-plane `/api/*` and APISIX admin `/apisix/admin/*` endpoints). Note: 3 APISIX resources (standalone upstream, consumer group, plugin config) are not exposed in API7 EE.
 - Support **multiple authentication modes**: access tokens (X-API-KEY with `a7ee` prefix) and session-based login.
 - Implement **gateway group** scoping for all runtime operations (enterprise-specific concept).
 - Implement context/profile management for switching between multiple API7 EE instances.
@@ -128,7 +128,7 @@ All runtime commands require `--gateway-group <id>` (or default from context).
 - `a7 service list|get|create|update|delete|export --gateway-group <id>`
 
 #### Upstreams
-- `a7 upstream list|get|create|update|delete|export --gateway-group <id>`
+> **⚠️ NOT SUPPORTED**: Standalone upstreams are not exposed via the API7 EE Admin API. Upstreams exist only as inline objects within services and routes. The `a7 upstream` commands exist for APISIX compatibility but will not work against API7 EE.
 
 #### Consumers
 - `a7 consumer list|get|create|update|delete|export --gateway-group <id>`
@@ -137,7 +137,7 @@ All runtime commands require `--gateway-group <id>` (or default from context).
 - `a7 credential list|get|create|update|delete --consumer <username> --gateway-group <id>`
 
 #### Consumer Groups
-- `a7 consumer-group list|get|create|update|delete|export --gateway-group <id>`
+> **⚠️ NOT SUPPORTED**: Consumer groups are not exposed via the API7 EE Admin API. The `a7 consumer-group` commands exist for APISIX compatibility but will not work against API7 EE.
 
 #### SSL Certificates
 - `a7 ssl list|get|create|update|delete|export --gateway-group <id>`
@@ -152,7 +152,7 @@ All runtime commands require `--gateway-group <id>` (or default from context).
 - `a7 stream-route list|get|create|update|delete|export --gateway-group <id>`
 
 #### Plugin Config
-- `a7 plugin-config list|get|create|update|delete|export --gateway-group <id>`
+> **⚠️ NOT SUPPORTED**: Plugin configs are not exposed via the API7 EE Admin API. The `a7 plugin-config` commands exist for APISIX compatibility but will not work against API7 EE.
 
 #### Plugin Metadata
 - `a7 plugin-metadata get|create|update|delete --gateway-group <id>` (no list — keyed by plugin name)
@@ -190,16 +190,16 @@ All runtime commands require `--gateway-group <id>` (or default from context).
 1. ✅ Gateway Group CRUD (list, get, create, update, delete).
 2. ✅ Service Template CRUD + publish.
 3. ✅ Route CRUD.
-4. ✅ Upstream CRUD.
+4. ✅ Upstream CRUD. ⚠️ Not functional in API7 EE (standalone upstreams not exposed).
 5. ✅ Service (runtime) CRUD.
 6. ✅ Consumer CRUD.
 7. ✅ SSL CRUD.
 8. ✅ Plugin list + get.
 9. ✅ Global Rule CRUD.
 10. ✅ Stream Route CRUD.
-11. ✅ Plugin Config CRUD.
+11. ✅ Plugin Config CRUD. ⚠️ Not functional in API7 EE (plugin_config not exposed).
 12. ✅ Plugin Metadata CRUD (no list).
-13. ✅ Consumer Group CRUD.
+13. ✅ Consumer Group CRUD. ⚠️ Not functional in API7 EE (consumer_group not exposed).
 14. ✅ Credential CRUD (nested under consumer).
 15. ✅ Secret CRUD.
 16. ✅ Proto CRUD.
@@ -317,7 +317,7 @@ The following table tracks feature parity between a7 and [a6](https://github.com
 
 | Feature | a6 | a7 | Notes |
 |---------|----|----|-------|
-| Resource CRUD (14 types) | ✅ | ✅ (16 types) | a7 adds gateway-group, service-template |
+| Resource CRUD (14 types) | ✅ | ✅ (13 functional in API7 EE) | a7 adds gateway-group, service-template; 3 APISIX resources (upstream, consumer-group, plugin-config) not exposed in API7 EE |
 | Context management | ✅ | ✅ | |
 | Shell completions | ✅ | ✅ | |
 | JSON/YAML/table output | ✅ | ✅ | |

README.md

@@ -6,9 +6,9 @@
 
 ## Features
 
-- **Resource CRUD** — Create, list, get, update, and delete 16 API7 EE resource types:
+- **Resource CRUD** — Create, list, get, update, and delete 13 API7 EE resource types:
   - **Control Plane**: Gateway Group, Service Template
-  - **Runtime**: Route, Upstream, Service, Consumer, SSL Certificate, Plugin, Global Rule, Stream Route, Plugin Config, Plugin Metadata, Consumer Group, Credential, Secret, Proto
+  - **Runtime**: Route, Service, Consumer, SSL Certificate, Plugin, Global Rule, Stream Route, Plugin Metadata, Credential, Secret, Proto
 - **Context management** — Switch between multiple API7 EE instances (`a7 context create`, `a7 context use`, `a7 context list`)
 - **Gateway group scoping** — All runtime operations are scoped to a gateway group via `--gateway-group` flag or context config
 - **Rich output** — Human-friendly tables in TTY, machine-readable JSON/YAML in pipes (`--output json|yaml|table`)
@@ -72,18 +72,11 @@ a7 gateway-group get <id> --output json
 ### 3. Create resources
 
 ```bash
-# Create an upstream
-a7 upstream create \
-  --name my-upstream \
-  --type roundrobin \
-  --nodes "httpbin.org:80=1"
+# Create a service with inline upstream
+a7 service create -g default -f service.yaml
 
 # Create a route
-a7 route create \
-  --name my-route \
-  --uri "/api/v1/*" \
-  --methods GET,POST \
-  --upstream-id <upstream-id>
+a7 route create -g default -f route.yaml
 ```
 
 ### 4. Read and explore
@@ -114,13 +107,9 @@ a7 route update <id> \
 ### 6. Clean up
 
 ```bash
-# Delete the route and upstream
-a7 route delete <id>
-a7 upstream delete <id>
-
-# Verify they're gone
-a7 route list
-a7 upstream list
+# Delete the route and service
+a7 route delete <id> -g default --force
+a7 service delete <id> -g default --force
 ```
 
 ## Commands
@@ -149,16 +138,13 @@ a7 upstream list
 | Command | Alias | Actions | Description |
 |---------|-------|---------|-------------|
 | `a7 route` | `rt` | list, get, create, update, delete | Manage routes |
-| `a7 upstream` | `us` | list, get, create, update, delete | Manage upstreams |
 | `a7 service` | `svc` | list, get, create, update, delete | Manage runtime services |
 | `a7 consumer` | `c` | list, get, create, update, delete | Manage consumers |
 | `a7 ssl` | — | list, get, create, update, delete | Manage SSL certificates |
 | `a7 plugin` | `pl` | list, get | Manage plugins |
 | `a7 global-rule` | `gr` | list, get, create, update, delete | Manage global rules |
 | `a7 stream-route` | `sr` | list, get, create, update, delete | Manage stream routes |
-| `a7 plugin-config` | `pc` | list, get, create, update, delete | Manage plugin configs |
 | `a7 plugin-metadata` | `pm` | get, create, update, delete | Manage plugin metadata |
-| `a7 consumer-group` | `cg` | list, get, create, update, delete | Manage consumer groups |
 | `a7 credential` | `cred` | list, get, create, update, delete | Manage consumer credentials |
 | `a7 secret` | `sec` | list, get, create, update, delete | Manage secret providers |
 | `a7 proto` | `pb` | list, get, create, update, delete | Manage protobuf definitions |
@@ -247,7 +233,7 @@ See [AGENTS.md](AGENTS.md) for the full development guide, coding conventions, a
 - [Coding Standards](docs/coding-standards.md)
 - [Testing Strategy](docs/testing-strategy.md)
 - [Development Roadmap](docs/roadmap.md)
-- [User Guides](docs/user-guide/) — Per-resource guides for all 16 resource types
+- [User Guides](docs/user-guide/) — Per-resource guides for all supported resource types
 
 ## Contributing
 

docs/api7ee-api-spec.md

@@ -89,8 +89,7 @@ All runtime resources require `gateway_group_id` query parameter.
 - **Fields**: `id`, `name`, `uris`, `methods`, `host`, `hosts`, `plugins`, `upstream_id`, `service_id`, `status`.
 
 ### 2. Upstream (/apisix/admin/upstreams)
-- **Methods**: `GET`, `GET /:id`, `POST`, `PUT /:id`, `PATCH /:id`, `DELETE /:id`
-- **Fields**: `id`, `name`, `type`, `nodes` (object/array), `checks`, `scheme`.
+> **⚠️ NOT EXPOSED in API7 EE.** Standalone upstreams do not have REST API endpoints. Upstreams exist only as inline objects within services and routes. This endpoint returns "resource not found".
 
 ### 3. Service (/apisix/admin/services)
 - **Methods**: `GET`, `GET /:id`, `POST`, `PUT /:id`, `PATCH /:id`, `DELETE /:id`
@@ -111,13 +110,13 @@ All runtime resources require `gateway_group_id` query parameter.
 - **Methods**: `GET`, `GET /:id`, `POST`, `DELETE /:id`
 
 ### 8. Plugin Config (/apisix/admin/plugin_configs)
-- **Methods**: `GET`, `GET /:id`, `PUT /:id`, `DELETE /:id`
+> **⚠️ NOT EXPOSED in API7 EE.** Plugin configs do not have REST API endpoints in API7 EE.
 
 ### 9. Plugin Metadata (/apisix/admin/plugin_metadata)
 - **Methods**: `GET /:plugin_name`, `PUT /:plugin_name`, `DELETE /:plugin_name`
 
 ### 10. Consumer Group (/apisix/admin/consumer_groups)
-- **Methods**: `GET`, `GET /:id`, `PUT /:id`, `DELETE /:id`
+> **⚠️ NOT EXPOSED in API7 EE.** Consumer groups do not have REST API endpoints in API7 EE.
 
 ### 11. Credential (/apisix/admin/consumers/:username/credentials)
 - **Methods**: `GET`, `GET /:id`, `PUT /:id`, `DELETE /:id`
@@ -133,23 +132,23 @@ All runtime resources require `gateway_group_id` query parameter.
   - `GET /apisix/admin/plugins/list`: List plugin names.
   - `GET /apisix/admin/plugins/:name`: Get plugin schema.
 
-## Summary of 16 Resource Types
-
-| Resource | Prefix | Identifier | Scope |
-|----------|--------|------------|-------|
-| Gateway Group | `/api` | `id` | Global |
-| Service Template | `/api` | `id` | Global |
-| Route | `/apisix/admin` | `id` | Gateway Group |
-| Upstream | `/apisix/admin` | `id` | Gateway Group |
-| Service | `/apisix/admin` | `id` | Gateway Group |
-| Consumer | `/apisix/admin` | `username` | Gateway Group |
-| SSL | `/apisix/admin` | `id` | Gateway Group |
-| Global Rule | `/apisix/admin` | `id` | Gateway Group |
-| Stream Route | `/apisix/admin` | `id` | Gateway Group |
-| Plugin Config | `/apisix/admin` | `id` | Gateway Group |
-| Plugin Metadata | `/apisix/admin` | `plugin_name`| Gateway Group |
-| Consumer Group | `/apisix/admin` | `id` | Gateway Group |
-| Credential | `/apisix/admin` | `id` | Consumer |
-| Secret | `/apisix/admin` | `manager/id`| Gateway Group |
-| Proto | `/apisix/admin` | `id` | Gateway Group |
-| Plugin | `/apisix/admin` | `name` | Gateway Group |
+## Summary of Resource Types
+
+| Resource | Prefix | Identifier | Scope | Status |
+|----------|--------|------------|-------|--------|
+| Gateway Group | `/api` | `id` | Global | ✅ |
+| Service Template | `/api` | `id` | Global | ✅ |
+| Route | `/apisix/admin` | `id` | Gateway Group | ✅ |
+| Upstream | `/apisix/admin` | `id` | Gateway Group | ⚠️ Not exposed |
+| Service | `/apisix/admin` | `id` | Gateway Group | ✅ |
+| Consumer | `/apisix/admin` | `username` | Gateway Group | ✅ |
+| SSL | `/apisix/admin` | `id` | Gateway Group | ✅ |
+| Global Rule | `/apisix/admin` | `id` | Gateway Group | ✅ |
+| Stream Route | `/apisix/admin` | `id` | Gateway Group | ✅ |
+| Plugin Config | `/apisix/admin` | `id` | Gateway Group | ⚠️ Not exposed |
+| Plugin Metadata | `/apisix/admin` | `plugin_name`| Gateway Group | ✅ |
+| Consumer Group | `/apisix/admin` | `id` | Gateway Group | ⚠️ Not exposed |
+| Credential | `/apisix/admin` | `id` | Consumer | ✅ |
+| Secret | `/apisix/admin` | `manager/id`| Gateway Group | ✅ |
+| Proto | `/apisix/admin` | `id` | Gateway Group | ✅ |
+| Plugin | `/apisix/admin` | `name` | Gateway Group | ✅ |

docs/documentation-maintenance.md

@@ -21,16 +21,14 @@ docs/
     ├── gateway-group.md           # Gateway group commands (EE)
     ├── service-template.md        # Service template commands (EE)
     ├── route.md                   # Route command reference
-    ├── upstream.md                # Upstream command reference
+    ├── upstream.md                # ⚠️ Deprecated — upstreams are inline-only in API7 EE
     ├── service.md                 # Service command reference
     ├── consumer.md                # Consumer command reference
     ├── ssl.md                     # SSL command reference
     ├── plugin.md                  # Plugin command reference
     ├── global-rule.md             # Global rule command reference
     ├── stream-route.md            # Stream route command reference
-    ├── plugin-config.md           # Plugin config command reference
     ├── plugin-metadata.md         # Plugin metadata command reference
-    ├── consumer-group.md          # Consumer group command reference
     ├── credential.md              # Credential command reference
     ├── secret.md                  # Secret command reference
     ├── proto.md                   # Proto command reference
@@ -40,7 +38,7 @@ docs/
     ├── custom-plugin.md           # Custom plugins (EE)
     ├── service-registry.md        # Service registries (EE)
     ├── token.md                   # Access tokens (EE)
-    └── ...                        # Total 29 files in user-guide
+    └── ...                        # Total 27 files in user-guide
 ```
 
 ### Mandatory Documentation Rules

docs/user-guide/bulk-operations.md

@@ -70,12 +70,9 @@ Bulk operations are planned for the following resources:
 
 - `route`
 - `service`
-- `upstream`
 - `consumer`
 - `ssl`
 - `global-rule`
-- `plugin-config`
-- `consumer-group`
 - `stream-route`
 - `proto`
 - `secret`