slug: amex-gbt
provider: American Express Global Business Travel
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Transportation & Logistics
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 3
edges:
- tag: gdpr-controller
  spec_file: amex-gbt-gdpr-controller-api-openapi.yml
  capability_id: BC-130.50
  capability_id_l1: BC-130
  capability_name: Privacy & Data Protection Management
  confidence: 0.85
  evidence: DELETE /gdpr  process; GET /gdpr  validate; schema 'UserGDPRValidationResponseBean'
  reason: Operations validate and process GDPR requests against user data (erasure/validation), which
    is squarely data-subject-rights handling under Privacy & Data Protection Management.
- tag: scim-v1-admin-users
  spec_file: amex-gbt-scim-v1-admin-users-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.75
  evidence: SCIM 2.0 compliant admin-users sync APIs; 'createAdminUser  Create a new admin user in the
    system'
  reason: SCIM-based provisioning, search and patching of admin user accounts is identity/account lifecycle
    management (joiners-movers-leavers), i.e. Identity & Access Management rather than HR records.
- tag: Company Details
  spec_file: amex-gbt-company-details-api-openapi.yml
  capability_id: BC-420.10
  capability_id_l1: BC-420
  capability_name: Customer Data Management
  confidence: 0.7
  evidence: GET /v1/companies  searchCompanies ; GET /v1/companies/{company_id}  retrieveCompany ; schemas
    Company_Search_Response, Company_Display_Name, Address
  reason: Search and retrieval of the client company record (names, addresses, phone, activation status)
    held by the travel platform — i.e. maintenance/lookup of the corporate customer master record. Read-only
    surface leaves some doubt about whether it is customer master vs general master data, hence 0.7.
  recovered_from: vertical-defense-aerospace-edges.json