generated: '2026-07-15' method: generated source: openapi/amazon-guardduty-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 67 by_action_class: acting: 48 connected: 19 by_consequence: write: 46 read: 19 safety-critical: 2 human_in_the_loop_required: 2 operations: - path: /detector/{detectorId}/administrator method: post operationId: AcceptAdministratorInvitation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/administrator method: get operationId: GetAdministratorAccount x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/master method: post operationId: AcceptInvitation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/master method: get operationId: GetMasterAccount x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/findings/archive method: post operationId: ArchiveFindings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector method: post operationId: CreateDetector x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector method: get operationId: ListDetectors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/filter method: post operationId: CreateFilter x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/filter method: get operationId: ListFilters x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/ipset method: post operationId: CreateIPSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/ipset method: get operationId: ListIPSets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/member method: post operationId: CreateMembers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member method: get operationId: ListMembers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/publishingDestination method: post operationId: CreatePublishingDestination x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/publishingDestination method: get operationId: ListPublishingDestinations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/findings/create method: post operationId: CreateSampleFindings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/threatintelset method: post operationId: CreateThreatIntelSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/threatintelset method: get operationId: ListThreatIntelSets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /invitation/decline method: post operationId: DeclineInvitations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId} method: delete operationId: DeleteDetector x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId} method: get operationId: GetDetector x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId} method: post operationId: UpdateDetector x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/filter/{filterName} method: delete operationId: DeleteFilter x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/filter/{filterName} method: get operationId: GetFilter x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/filter/{filterName} method: post operationId: UpdateFilter x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/ipset/{ipSetId} method: delete operationId: DeleteIPSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/ipset/{ipSetId} method: get operationId: GetIPSet x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/ipset/{ipSetId} method: post operationId: UpdateIPSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /invitation/delete method: post operationId: DeleteInvitations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/delete method: post operationId: DeleteMembers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/publishingDestination/{destinationId} method: delete operationId: DeletePublishingDestination x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/publishingDestination/{destinationId} method: get operationId: DescribePublishingDestination x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/publishingDestination/{destinationId} method: post operationId: UpdatePublishingDestination x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/threatintelset/{threatIntelSetId} method: delete operationId: DeleteThreatIntelSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/threatintelset/{threatIntelSetId} method: get operationId: GetThreatIntelSet x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/threatintelset/{threatIntelSetId} method: post operationId: UpdateThreatIntelSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/malware-scans method: post operationId: DescribeMalwareScans x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/admin method: get operationId: DescribeOrganizationConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/admin method: post operationId: UpdateOrganizationConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/disable method: post operationId: DisableOrganizationAdminAccount x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /detector/{detectorId}/administrator/disassociate method: post operationId: DisassociateFromAdministratorAccount x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/master/disassociate method: post operationId: DisassociateFromMasterAccount x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/disassociate method: post operationId: DisassociateMembers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/enable method: post operationId: EnableOrganizationAdminAccount x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/coverage/statistics method: post operationId: GetCoverageStatistics x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/findings/get method: post operationId: GetFindings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/findings/statistics method: post operationId: GetFindingsStatistics x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /invitation/count method: get operationId: GetInvitationsCount x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/malware-scan-settings method: get operationId: GetMalwareScanSettings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detector/{detectorId}/malware-scan-settings method: post operationId: UpdateMalwareScanSettings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/detector/get method: post operationId: GetMemberDetectors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/get method: post operationId: GetMembers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/freeTrial/daysRemaining method: post operationId: GetRemainingFreeTrialDays x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/usage/statistics method: post operationId: GetUsageStatistics x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/invite method: post operationId: InviteMembers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/coverage method: post operationId: ListCoverage x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/findings method: post operationId: ListFindings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /invitation method: get operationId: ListInvitations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin method: get operationId: ListOrganizationAdminAccounts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tags/{resourceArn} method: get operationId: ListTagsForResource x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tags/{resourceArn} method: post operationId: TagResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/start method: post operationId: StartMonitoringMembers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/stop method: post operationId: StopMonitoringMembers x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /detector/{detectorId}/findings/unarchive method: post operationId: UnarchiveFindings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tags/{resourceArn}#tagKeys method: delete operationId: UntagResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/findings/feedback method: post operationId: UpdateFindingsFeedback x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /detector/{detectorId}/member/detector/update method: post operationId: UpdateMemberDetectors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required