generated: '2026-07-15' method: generated source: openapi/bamboo-openapi.json, openapi/bamboo-openapi.yaml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 102 by_action_class: acting: 30 connected: 72 by_consequence: safety-critical: 22 read: 72 write: 2 physical: 6 human_in_the_loop_required: 22 operations: - path: /oauth/token method: post operationId: Web.Api.AuthController.oauth x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/one_step_registration method: post operationId: Web.Api.RegisterController.registration_step x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/one_step_registration method: post operationId: Web.Api.RegisterController.registration_step x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/dictionary method: get operationId: Web.Api.RegisterController.dictionary x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/brokerage_accounts method: post x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/profile method: get operationId: Web.Api.ProfileController.profile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/investment_profile method: get operationId: Web.Api.ProfileController.investment_profile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /bamboo/webhook method: post operationId: Web.Api.TransactionController.webhook x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/tenant/deposit method: get operationId: Web.Api.Tenant.TenantDepositController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/deposit/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/deposit/status/{txref} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant_brokerage_withdraw method: post operationId: Web.Api.WithdrawController.tenant_brokerage_withdraw_ngn x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/tenant/withdraws method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/withdraw/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/withdraw/status/{reference} method: get operationId: Web.Api.Tenant.WithdrawController.withdraw_status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/themes method: get operationId: Web.Api.ThemeController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/themed_stock/{theme_id} method: get operationId: Web.Api.ThemeController.show x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/exchange_rate method: get operationId: Web.Api.Tenant.ExchangeRateController.exchange_rate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/market/open_date method: get operationId: Web.Api.Tenant.ExchangeRateController.market_activity x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/extended_hours/opt_in method: post x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/document_list method: get operationId: Web.Api.Tenant.ExchangeRateController.exchange_rate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/document method: get operationId: Web.Api.Tenant.DocumentController.document x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/portfolio method: get operationId: Web.Api.PortfolioController.portfolio x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/portfolio/breakdown method: get operationId: Web.Api.PortfolioController.portfolio_breakdown x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/stock/{stockSymbol}/ownership method: get operationId: Web.Api.PortfolioController.ownership x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/stocks method: get operationId: Web.Api.StockController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/stock/{symbol}/details method: get operationId: Web.Api.StockDataController.details x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/stock/search method: get operationId: Web.Api.StockController.search x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/my_stocks method: get operationId: Web.Api.StockDataController.ownership x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/order/calculate method: post operationId: Web.Api.OrderController.calculate_market_order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/order method: post operationId: Web.Api.OrderController.place_market_order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/order/{id}/status method: get operationId: Web.Api.OrderController.status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/pending_orders method: get operationId: Web.Api.OrderController.pending x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/order/{id}/cancel method: post x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lsx/ng/dictionary method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: https://cscs-banks.investbamboo.com/ method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/portfolio/breakdown method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/user_cash_balance/{currency} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/deposit method: post x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lsx/ng/deposit/{reference} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/withdraw method: post operationId: Web.Api.WithdrawController.tenant_brokerage_withdraw_ngn x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/lsx/ng/withdraw/{reference} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/stocks method: get operationId: Web.Api.StockController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/stocks/{symbol} method: get operationId: Web.Api.StockDataController.about x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/my_stocks method: get operationId: Web.Api.StockController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/order/calculate method: post operationId: Web.Api.OrderController.calculate_order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/lsx/ng/order method: post operationId: Web.Api.OrderController.order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/lsx/ng/order/:order_id method: get operationId: Web.Api.OrderController.status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/order/:order_id/status method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/pending_orders method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/order/:order_id/cancel method: post x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth/token method: post operationId: Web.Api.AuthController.oauth x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/one_step_registration method: post operationId: Web.Api.RegisterController.registration_step x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/one_step_registration method: post operationId: Web.Api.RegisterController.registration_step x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/dictionary method: get operationId: Web.Api.RegisterController.dictionary x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/brokerage_accounts method: post x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/profile method: get operationId: Web.Api.ProfileController.profile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/investment_profile method: get operationId: Web.Api.ProfileController.investment_profile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /bamboo/webhook method: post operationId: Web.Api.TransactionController.webhook x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/tenant/deposit method: get operationId: Web.Api.Tenant.TenantDepositController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/deposit/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/deposit/status/{txref} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant_brokerage_withdraw method: post operationId: Web.Api.WithdrawController.tenant_brokerage_withdraw_ngn x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/tenant/withdraws method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/withdraw/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/withdraw/status/{reference} method: get operationId: Web.Api.Tenant.WithdrawController.withdraw_status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/themes method: get operationId: Web.Api.ThemeController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/themed_stock/{theme_id} method: get operationId: Web.Api.ThemeController.show x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/exchange_rate method: get operationId: Web.Api.Tenant.ExchangeRateController.exchange_rate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/market/open_date method: get operationId: Web.Api.Tenant.ExchangeRateController.market_activity x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/extended_hours/opt_in method: post x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/document_list method: get operationId: Web.Api.Tenant.ExchangeRateController.exchange_rate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/document method: get operationId: Web.Api.Tenant.DocumentController.document x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/portfolio method: get operationId: Web.Api.PortfolioController.portfolio x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/portfolio/breakdown method: get operationId: Web.Api.PortfolioController.portfolio_breakdown x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/stock/{stockSymbol}/ownership method: get operationId: Web.Api.PortfolioController.ownership x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/stocks method: get operationId: Web.Api.StockController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/tenant/stock/{symbol}/details method: get operationId: Web.Api.StockDataController.details x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/stock/search method: get operationId: Web.Api.StockController.search x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/my_stocks method: get operationId: Web.Api.StockDataController.ownership x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/order/calculate method: post operationId: Web.Api.OrderController.calculate_market_order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/order method: post operationId: Web.Api.OrderController.place_market_order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/order/{id}/status method: get operationId: Web.Api.OrderController.status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/pending_orders method: get operationId: Web.Api.OrderController.pending x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/order/{id}/cancel method: post x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lsx/ng/dictionary method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: https://cscs-banks.investbamboo.com/ method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/portfolio/breakdown method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/user_cash_balance/{currency} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/deposit method: post x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lsx/ng/deposit/{reference} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/withdraw method: post operationId: Web.Api.WithdrawController.tenant_brokerage_withdraw_ngn x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/lsx/ng/withdraw/{reference} method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/stocks method: get operationId: Web.Api.StockController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/stocks/{symbol} method: get operationId: Web.Api.StockDataController.about x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/my_stocks method: get operationId: Web.Api.StockController.index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/order/calculate method: post operationId: Web.Api.OrderController.calculate_order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/lsx/ng/order method: post operationId: Web.Api.OrderController.order x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/lsx/ng/order/:order_id method: get operationId: Web.Api.OrderController.status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/order/:order_id/status method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/pending_orders method: get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lsx/ng/order/:order_id/cancel method: post x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required