generated: '2026-07-15' method: generated source: openapi/cloudflare-r2-cloudflare-api-openapi.yml, openapi/cloudflare-r2-s3-compatible-api-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 67 by_action_class: connected: 30 acting: 37 by_consequence: read: 30 write: 35 safety-critical: 2 human_in_the_loop_required: 2 operations: - path: /accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration method: get operationId: r2-get-event-notification-configs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id} method: delete operationId: r2-event-notification-delete-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id} method: get operationId: r2-get-event-notification-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id} method: put operationId: r2-put-event-notification-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2-catalog method: get operationId: list-catalogs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2-catalog/{bucket_name} method: get operationId: get-catalog-details x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2-catalog/{bucket_name}/credential method: post operationId: store-credentials x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2-catalog/{bucket_name}/disable method: post operationId: disable-catalog x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /accounts/{account_id}/r2-catalog/{bucket_name}/enable method: post operationId: enable-catalog x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2-catalog/{bucket_name}/maintenance-configs method: get operationId: get-maintenance-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2-catalog/{bucket_name}/maintenance-configs method: post operationId: update-maintenance-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2-catalog/{bucket_name}/namespaces method: get operationId: list-namespaces x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2-catalog/{bucket_name}/namespaces/{namespace}/tables method: get operationId: list-tables x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2-catalog/{bucket_name}/namespaces/{namespace}/tables/{table_name}/maintenance-configs method: get operationId: get-table-maintenance-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2-catalog/{bucket_name}/namespaces/{namespace}/tables/{table_name}/maintenance-configs method: post operationId: update-table-maintenance-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets method: get operationId: r2-list-buckets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets method: post operationId: r2-create-bucket x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name} method: delete operationId: r2-delete-bucket x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name} method: get operationId: r2-get-bucket x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name} method: patch operationId: r2-patch-bucket x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/cors method: delete operationId: r2-delete-bucket-cors-policy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/cors method: get operationId: r2-get-bucket-cors-policy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/cors method: put operationId: r2-put-bucket-cors-policy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom method: get operationId: r2-list-custom-domains x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom method: post operationId: r2-add-custom-domain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain} method: delete operationId: r2-delete-custom-domain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain} method: get operationId: r2-get-custom-domain-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain} method: put operationId: r2-edit-custom-domain-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/domains/managed method: get operationId: r2-get-bucket-public-policy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/domains/managed method: put operationId: r2-put-bucket-public-policy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/lifecycle method: get operationId: r2-get-bucket-lifecycle-configuration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/lifecycle method: put operationId: r2-put-bucket-lifecycle-configuration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/local-uploads method: get operationId: r2-get-bucket-local-uploads-configuration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/local-uploads method: put operationId: r2-put-bucket-local-uploads-configuration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/lock method: get operationId: r2-get-bucket-lock-configuration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/lock method: put operationId: r2-put-bucket-lock-configuration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/objects method: delete operationId: r2-delete-objects x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/objects method: get operationId: r2-list-objects x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/objects/{object_key} method: delete operationId: r2-delete-object x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/objects/{object_key} method: get operationId: r2-get-object x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/objects/{object_key} method: put operationId: r2-put-object x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/sippy method: delete operationId: r2-delete-bucket-sippy-config x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /accounts/{account_id}/r2/buckets/{bucket_name}/sippy method: get operationId: r2-get-bucket-sippy-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/buckets/{bucket_name}/sippy method: put operationId: r2-put-bucket-sippy-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{account_id}/r2/metrics method: get operationId: r2-get-account-level-metrics x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{account_id}/r2/temp-access-credentials method: post operationId: r2-create-temp-access-credentials x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: / method: get operationId: list-buckets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket} method: head operationId: head-bucket x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket} method: put operationId: create-bucket x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket} method: delete operationId: delete-bucket x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket} method: get operationId: list-objects-v2 x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket}?cors method: get operationId: get-bucket-cors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket}?cors method: put operationId: put-bucket-cors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}?cors method: delete operationId: delete-bucket-cors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}?lifecycle method: get operationId: get-bucket-lifecycle x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket}?lifecycle method: put operationId: put-bucket-lifecycle x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}/{key} method: head operationId: head-object x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket}/{key} method: get operationId: get-object x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket}/{key} method: put operationId: put-object x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}/{key} method: delete operationId: delete-object x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}?delete method: post operationId: delete-objects x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}/{key}?uploads method: post operationId: create-multipart-upload x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}/{key}?partNumber={partNumber}&uploadId={uploadId} method: put operationId: upload-part x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}/{key}?uploadId={uploadId} method: post operationId: complete-multipart-upload x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}/{key}?uploadId={uploadId} method: delete operationId: abort-multipart-upload x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /{bucket}/{key}?uploadId={uploadId} method: get operationId: list-parts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /{bucket}?uploads method: get operationId: list-multipart-uploads x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none