# STEP_034C2 clean WGPay test peer runbook

This package is read-only. It is intended to confirm the exact existing WG Access API path before creating a test peer.

Expected apply path after review:
- Create:
  POST http://127.0.0.1:18080/admin/subscriptions
  body:
  {
    "email": "wgpay-canary-<timestamp>@example.invalid",
    "months": 1,
    "plan_code": "canary-test",
    "node_id": "<confirmed MGTS node_id>",
    "auto_renew": false
  }

- Capture privately:
  user_id, subscription_id, peer_id, job_id, node_id, tunnel_ip, paid_until, client_config
  Do not publish private_key, preshared_key, or client_config.

- Apply to VM100 through existing agent/job flow if needed.

- Rollback:
  POST /admin/subscriptions/{subscription_id}/cancel
  or
  POST /admin/peers/{peer_id}/disable