generated: '2026-07-31' method: generated source: openapi/anecdotes-fedramp-20x-openapi.yml, openapi/anecdotes-grc-openapi-original.json, openapi/anecdotes-grc-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 114 by_action_class: acting: 49 connected: 65 by_consequence: write: 39 read: 65 safety-critical: 10 human_in_the_loop_required: 10 operations: - path: /fedramp20x/v1/access method: post operationId: requestFedrampAccess x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /fedramp20x/v1/public/info method: get operationId: getPublicInfo x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/v1/apikey/exchange method: get operationId: exchangeApiKeyFedramp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /fedramp20x/v1/access/token method: get operationId: listFedrampTokens x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /fedramp20x/v1/authorization-package method: get operationId: getAuthorizationPackage x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /fedramp20x/v1/ksi/{ksi_code} method: get operationId: getKsi x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /fedramp20x/v1/evidence/{evidence_id} method: get operationId: getFedrampEvidence x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /fedramp20x/v1/evidence/{evidence_id}/history method: get operationId: getFedrampEvidenceHistory x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /analysis-rules/v1/analysis-rules method: get operationId: getAnalysisRules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /analysis-rules/v1/analysis-rules method: post operationId: createAnalysisRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /analysis-rules/v1/analysis-rules/rule_results_by_filter method: get operationId: getAnalysisRulesResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/framework method: get operationId: getFrameworks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/framework/{framework_id}/download method: get operationId: exportFramework x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/requirement method: get operationId: listRequirements x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/requirement/ method: post operationId: createRequirement x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirement/{requirement_id} method: get operationId: getRequirementById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/requirement/{requirement_id}/ method: delete operationId: deleteRequirement x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirement/{requirement_id}/ method: patch operationId: updateRequirement x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirement/{requirement_id}/fields/{field_id} method: patch operationId: setRequirementCustomFieldValue x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirements/fields method: get operationId: listRequirementCustomFieldValues x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /compliance/v1/findings method: get operationId: listFindings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /compliance/v1/findings method: post operationId: createFinding x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /compliance/v1/findings method: delete operationId: deleteFindings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /compliance/v1/findings/{finding_id} method: get operationId: getFindingById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /compliance/v1/findings/{finding_id} method: patch operationId: patchFinding x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /controls/control method: post operationId: createCustomControl x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/control method: get operationId: listControls x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/control/framework/{framework_id} method: get operationId: getControlsByFramework x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/control/read method: post operationId: getControlsByIds x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/control/{control_id} method: get operationId: getControlById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/control/{control_id} method: put operationId: updateCustomControl x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/control/{control_id} method: delete operationId: deleteCustomControl x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/controls/fields method: get operationId: getControlCustomFieldValues x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/controls/{control_id}/fields/{field_id} method: patch operationId: patchControlCustomField x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /custom-fields/v1/fields method: get operationId: listCustomFields x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /custom-fields/v1/fields method: post operationId: createCustomField x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /custom-fields/v1/fields/{field_id} method: get operationId: getCustomField x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence method: post operationId: uploadManualEvidence x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence method: get operationId: getEvidence x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/create method: post operationId: createEvidenceCollection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence/{evidence_id} method: get operationId: getAnEvidence x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_id}/attach method: post operationId: attachEvidenceToCollection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence/{evidence_id}/latest_raw method: get operationId: getLatestRawData x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_id}/run_history method: get operationId: getCollectionMultiHistory x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/download_raw method: get operationId: downloadRawData x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/full_data method: get operationId: getEvidenceFullData x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/fulldata_or_raw method: get operationId: getEvidenceFullDataOrRaw x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/ipe method: post operationId: attachEvidenceIpe x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence/{evidence_instance_id}/raw method: get operationId: getEvidenceRaw x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/v1/apikey/exchange method: get operationId: exchangeApiKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policy/v1/customer-policies method: get operationId: listPolicyCustomerPolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policy/v1/library-policies method: get operationId: listPolicyLibraryPolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policy/v1/policies/delete-policies method: put operationId: deletePolicies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v1/policies/update-settings method: put operationId: updatePolicySettings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v1/policies/{policy_id} method: patch operationId: patchPolicyRelatedEvidence x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v2/policies method: post operationId: createPolicies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v2/policies/{policy_id}/versions method: get operationId: listPolicyVersions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /risk/v1/risk method: post operationId: createRisk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /risk/v1/risk/full method: get operationId: getRisks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /risk/v1/risk/{risk_id} method: get operationId: getRisk x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /risk/v1/risk/{risk_id} method: patch operationId: updateRisk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /analysis-rules/v1/analysis-rules method: get operationId: getAnalysisRules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /analysis-rules/v1/analysis-rules method: post operationId: createAnalysisRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /analysis-rules/v1/analysis-rules/rule_results_by_filter method: get operationId: getAnalysisRulesResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/framework method: get operationId: getFrameworks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/framework/{framework_id}/download method: get operationId: exportFramework x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/requirement method: get operationId: listRequirements x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/requirement/ method: post operationId: createRequirement x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirement/{requirement_id} method: get operationId: getRequirementById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/requirement/{requirement_id}/ method: delete operationId: deleteRequirement x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirement/{requirement_id}/ method: patch operationId: updateRequirement x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirement/{requirement_id}/fields/{field_id} method: patch operationId: setRequirementCustomFieldValue x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/requirements/fields method: get operationId: listRequirementCustomFieldValues x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /compliance/v1/findings method: get operationId: listFindings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /compliance/v1/findings method: post operationId: createFinding x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /compliance/v1/findings method: delete operationId: deleteFindings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /compliance/v1/findings/{finding_id} method: get operationId: getFindingById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /compliance/v1/findings/{finding_id} method: patch operationId: patchFinding x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /controls/control method: post operationId: createCustomControl x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/control method: get operationId: listControls x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/control/framework/{framework_id} method: get operationId: getControlsByFramework x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/control/read method: post operationId: getControlsByIds x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/control/{control_id} method: get operationId: getControlById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/control/{control_id} method: put operationId: updateCustomControl x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/control/{control_id} method: delete operationId: deleteCustomControl x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /controls/controls/fields method: get operationId: getControlCustomFieldValues x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /controls/controls/{control_id}/fields/{field_id} method: patch operationId: patchControlCustomField x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /custom-fields/v1/fields method: get operationId: listCustomFields x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /custom-fields/v1/fields method: post operationId: createCustomField x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /custom-fields/v1/fields/{field_id} method: get operationId: getCustomField x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence method: post operationId: uploadManualEvidence x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence method: get operationId: getEvidence x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/create method: post operationId: createEvidenceCollection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence/{evidence_id} method: get operationId: getAnEvidence x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_id}/attach method: post operationId: attachEvidenceToCollection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence/{evidence_id}/latest_raw method: get operationId: getLatestRawData x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_id}/run_history method: get operationId: getCollectionMultiHistory x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/download_raw method: get operationId: downloadRawData x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/full_data method: get operationId: getEvidenceFullData x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/fulldata_or_raw method: get operationId: getEvidenceFullDataOrRaw x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /evidence/v1/evidence/{evidence_instance_id}/ipe method: post operationId: attachEvidenceIpe x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /evidence/v1/evidence/{evidence_instance_id}/raw method: get operationId: getEvidenceRaw x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/v1/apikey/exchange method: get operationId: exchangeApiKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policy/v1/customer-policies method: get operationId: listPolicyCustomerPolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policy/v1/library-policies method: get operationId: listPolicyLibraryPolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policy/v1/policies/delete-policies method: put operationId: deletePolicies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v1/policies/update-settings method: put operationId: updatePolicySettings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v1/policies/{policy_id} method: patch operationId: patchPolicyRelatedEvidence x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v2/policies method: post operationId: createPolicies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy/v2/policies/{policy_id}/versions method: get operationId: listPolicyVersions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /risk/v1/risk method: post operationId: createRisk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /risk/v1/risk/full method: get operationId: getRisks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /risk/v1/risk/{risk_id} method: get operationId: getRisk x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /risk/v1/risk/{risk_id} method: patch operationId: updateRisk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required