diff --git a/par-api/src/main/java/com/par/api/controller/SiteController.java b/par-api/src/main/java/com/par/api/controller/SiteController.java
index a7ab5d0..fe815d9 100644
--- a/par-api/src/main/java/com/par/api/controller/SiteController.java
+++ b/par-api/src/main/java/com/par/api/controller/SiteController.java
@@ -2,14 +2,18 @@ package com.par.api.controller;
 
 import com.par.core.dto.ApiResponse;
 import com.par.core.dto.SiteDTO;
+import com.par.core.entity.Site;
 import com.par.core.service.SiteService;
+import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
+import java.util.Map;
 
 /**
- * 站点控制器（读取公开）
+ * 站点控制器
+ * 读取公开，提交需 HMAC 鉴权
  */
 @RestController
 @RequestMapping("/api/v1/sites")
@@ -33,4 +37,33 @@ public class SiteController {
     public ApiResponse<SiteDTO> getSite(@PathVariable String siteId) {
         return ApiResponse.success(siteService.toDTO(siteService.findBySiteId(siteId)));
     }
+
+    /**
+     * 提交站点收录（需 HMAC 鉴权）
+     * 创建或更新站点信息，自动设置为活跃状态
+     */
+    @PostMapping("/{siteId}/submit")
+    public ApiResponse<SiteDTO> submitSite(
+            @PathVariable String siteId,
+            @RequestBody Map<String, Object> payload,
+            HttpServletRequest request) {
+
+        String name = (String) payload.get("name");
+        String description = (String) payload.get("description");
+        String baseUrl = (String) payload.get("baseUrl");
+        String iconUrl = (String) payload.get("iconUrl");
+        String siteType = (String) payload.get("siteType");
+
+        if (name == null || name.isBlank()) {
+            return ApiResponse.error(400, "name is required");
+        }
+        if (baseUrl == null || baseUrl.isBlank()) {
+            return ApiResponse.error(400, "baseUrl is required");
+        }
+
+        Long submitterId = (Long) request.getAttribute("accountId");
+
+        Site site = siteService.submitSite(siteId, name, description, baseUrl, iconUrl, siteType, submitterId);
+        return ApiResponse.success(siteService.toDTO(site));
+    }
 }