diff --git a/site/config/loader.py b/site/config/loader.py
index 74ee918..5dc0c37 100644
--- a/site/config/loader.py
+++ b/site/config/loader.py
@@ -80,7 +80,7 @@ SERVICES = _DF["SERVICES"]
 OPS_INDEX = _DF["OPS_INDEX"]
 
 DELAY = float(os.getenv("MOCK_OP_DELAY", "0.1"))
-VERSION = "0.5.5"
+VERSION = "0.5.6"
 
 
 def get_services(stand_id):
diff --git a/site/routes/mock_routes.py b/site/routes/mock_routes.py
index 205473d..e7c6630 100644
--- a/site/routes/mock_routes.py
+++ b/site/routes/mock_routes.py
@@ -97,7 +97,7 @@ def mock_services():
     не дёргая реальный /api/v1/svc/services.
     """
     result = {}
-    for svc_id, svc_def in _cfg.SERVICES.items():
+    for svc_id, svc_def in SERVICES.items():
         result[str(svc_id)] = {
             "name": svc_def.get("name", ""),
             "displayName": svc_def.get("service_display_name", ""),
diff --git a/site/routes/openapi.py b/site/routes/openapi.py
index 56e144b..5a912b3 100644
--- a/site/routes/openapi.py
+++ b/site/routes/openapi.py
@@ -429,7 +429,7 @@ def _build_paths():
                     "content": {
                         "application/json": {
                             "schema": {"$ref": "#/components/schemas/CreateInstanceRequest"},
-                            "example": {"serviceId": 38, "displayName": "my-test-instance"},
+                            "example": {"serviceId": 1, "displayName": "my-test-instance"},
                         },
                     },
                 },
diff --git a/site/routes/operations_routes.py b/site/routes/operations_routes.py
index f0e01a6..2fc7495 100644
--- a/site/routes/operations_routes.py
+++ b/site/routes/operations_routes.py
@@ -237,6 +237,10 @@ def set_operation_param():
     if not op_uid or param_id is None:
         return jsonify({"error": "instanceOperationUid and svcOperationCfsParamId required"}), 400
 
+    # Валидация: svcOperationCfsParamId должен быть целым числом
+    if not isinstance(param_id, int) or isinstance(param_id, bool):
+        return jsonify({"error": "svcOperationCfsParamId must be an integer"}), 400
+
     # Проверка что операция существует
     if not state.get_operation(op_uid):
         return jsonify({"error": "operation not found"}), 404
diff --git a/site/routes/run.py b/site/routes/run.py
index 3417ddf..abeb2f3 100644
--- a/site/routes/run.py
+++ b/site/routes/run.py
@@ -72,7 +72,7 @@ def run_operation(uid):
 
     # Применить эффект операции к состоянию инстанса
     # (create → running+params, delete → удалить, modify → мерж params, ...)
-    state_machine.apply_effect(uid, st, _cfg.SERVICES)
+    state_machine.apply_effect(uid, st, SERVICES)
 
     # Фиксируем время завершения — операция выполнена успешно
     op["dtFinish"] = _now()
diff --git a/site/templates/swagger.html b/site/templates/swagger.html
index 0ba4829..b9c8787 100644
--- a/site/templates/swagger.html
+++ b/site/templates/swagger.html
@@ -92,15 +92,15 @@
             showCommonExtensions: true,
             // Предзаполняем токен для _mock/*
             onComplete: function () {
-                const authToken = "{{ auth_token }}";
+                const authToken = {{ auth_token | tojson }};
                 if (authToken) {
                     ui.preauthorizeApiKey("mockAuth", authToken);
                 }
             },
             requestInterceptor: function (req) {
                 // Добавляем X-Mock-Auth только для _mock/* эндпоинтов
-                if (req.url.indexOf("/_mock/") !== -1 && "{{ auth_token }}") {
-                    req.headers["X-Mock-Auth"] = "{{ auth_token }}";
+                if (req.url.indexOf("/_mock/") !== -1 && {{ auth_token | tojson }}) {
+                    req.headers["X-Mock-Auth"] = {{ auth_token | tojson }};
                 }
                 return req;
             },
diff --git a/tests/fuzz_test.py b/tests/fuzz_test.py
index 9946ab8..4582309 100644
--- a/tests/fuzz_test.py
+++ b/tests/fuzz_test.py
@@ -86,7 +86,7 @@ for sid in stands:
         json={"serviceId": -1, "displayName": "x"}, headers=H), 400))
 
     t("serviceId=0", lambda: st(client.post(f"{base}/api/v1/svc/instances",
-        json={"serviceId": 0, "displayName": "x"}, headers=H), 404))
+        json={"serviceId": 0, "displayName": "x"}, headers=H), 400))
 
     t("displayName=число", lambda: st(client.post(f"{base}/api/v1/svc/instances",
         json={"serviceId": 1, "displayName": 12345}, headers=H), 201))